Detections
Analytics

6.2.4.4 Ensure audit log files group owner is configured

Information

Audit log files contain information about the system and system activity.

Access to audit records can reveal system and configuration data to attackers, potentially compromising its confidentiality.

Solution

- Run the following command to configure the audit log files to be owned by adm group:

# find $(dirname $(awk -F"=" '/^\s*log_file\s*=\s*/ {print $2}' /etc/audit/auditd.conf | xargs)) -type f \( ! -group adm -a ! -group root \) -exec chgrp adm {} +

 - Run the following command to set the log_group parameter in the audit configuration file to log_group = adm :

# sed -ri 's/^\s*#?\s*log_group\s*=\s*\S+(\s*#.*)?.*$/log_group = adm\1/' /etc/audit/auditd.conf

 - Run the following command to restart the audit daemon to reload the configuration file:

# service auditd restart

Note: If the audit log file directory is not configured ( log_file is unset in /etc/audit/auditd.conf ), set a valid log_file location before applying the steps above.

Impact:

Restricting audit log file group ownership to adm (or root ) may prevent groups that previously relied on access from reading the logs.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|AU-9, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: 9146bb3d5d27e9f6737d889eb6562569cd49739e8aab6a1a521dd89430b6cd4e