Detections
Analytics

4.1.2.4 Ensure access on /audit and /etc/security/audit is configured

Information

This recommendation verifies the access control settings for the default locations of AUDIT configuration and output files.

The default location for the AUDIT subsystem configuration files are in /etc/security/audit . The default location for output produced by the audit subsystem is the firectory /audit.

Access control must prevent unauthorized access.

NOTE: If your configuration does not store output in /audit ensure this directory is configured to prevent unauthorized access.

Solution

Ensure correct ownership and permissions are in place for /etc/security/audit and /audit.

#!/usr/bin/ksh -e
# Provided to CIS by AIXTools
# Copyright AIXTools, 2022
AUDITDIRS="/etc/security/audit /audit"
find ${AUDITDIRS} | grep -v 'lost+found' | xargs chown root:audit
find ${AUDITDIRS} -type d | grep -v 'lost+found' | xargs chmod g-w,o-rwx
find ${AUDITDIRS} ! -type d | grep -v 'lost+found' | xargs chmod -R u-x,g-wx,o-rwx
done

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: 72b0047666c6b95b773455cd3ba4a57b18ab21c60bd2ae8484c724e7851c7e17