Detections
Analytics

6.2.4.3 Ensure audit log files owner is configured

Information

Audit log files contain information about the system and system activity.

Access to audit records can reveal system and configuration data to attackers, potentially compromising its confidentiality.

Solution

Run the following command to configure the audit log files to be owned by the root user:

# [ -f /etc/audit/auditd.conf ] && find "$(dirname $(awk -F "=" '/^\s*log_file/ {print $2}' /etc/audit/auditd.conf | xargs))" -type f ! -user root -exec chown root {} +

See Also

https://workbench.cisecurity.org/benchmarks/25279

Item Details

Category: ACCESS CONTROL, CONFIGURATION MANAGEMENT, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|CM-7, 800-53|MP-2, CSCv7|14.6, Rule-ID|SV-230397r627750_rule, Vuln-ID|V-230397

Plugin: Unix

Control ID: 3b1d79333b91e9516a91d8e6ba770d6153c6fb497718f5f2ca546eb3ec7d3322