Detections
Analytics

6.2.4.2 Ensure audit log files mode is configured

Information

Audit log files contain information about the system and system activity.

Access to audit records can reveal system and configuration data to attackers, potentially compromising its confidentiality.

Solution

Run the following command to remove more permissive mode than 0640 from audit log files:

# [ -f /etc/audit/auditd.conf ] && find "$(dirname $(awk -F "=" '/^\s*log_file/ {print $2}' /etc/audit/auditd.conf | xargs))" -type f -perm /0137 -exec chmod u-x,g-wx,o-rwx {} +

Impact:

Restricting audit log file permissions to the recommended mode may prevent tools or users that previously relied on broader access from reading the logs.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|AU-9, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: c22dda84aab5f7b1508ffe6ab1a499a170c82d960de2fecaaf82bf556d8999ea