Detections
Analytics

1.148 OL09-00-000785

Information

OL 9 audit logs must be group-owned by root or by a restricted logging group to prevent unauthorized read access.

GROUP ID: V-271583
RULE ID: SV-271583r1091461

Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality.

Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000206-GPOS-00084

Solution

Configure OL 9 audit logs to be group-owned by "root" or a restricted logging group.

Change the group of the directory of "/var/log/audit" to be owned by a correct group.

Identify the group that is configured to own audit log:

$ sudo grep -P '^[ ]*log_group[ ]+=.*$' /etc/audit/auditd.conf

Change the ownership to that group:

$ sudo chgrp ${GROUP} /var/log/audit

See Also

https://workbench.cisecurity.org/benchmarks/27024

Item Details

Category: AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AU-9, 800-53|SI-11b., CCI|CCI-000162, CCI|CCI-000163, CCI|CCI-000164, CCI|CCI-001314, Rule-ID|SV-271583r1091461_rule, STIG-ID|OL09-00-000785, Vuln-ID|V-271583

Plugin: Unix

Control ID: b211a00cc3c7ad9663a8b90bc955c0d1beb498c64202793ff3485af9dd80d85c