Detections
Analytics

6.3.4.4 Ensure audit log files group owner is configured

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Audit log files contain information about the system and system activity.

Access to audit records can reveal system and configuration data to attackers, potentially compromising its confidentiality.

Solution

Run the following command to configure the audit log files to be owned by adm group:

# find $(dirname $(awk -F"=" '/^\s*log_file\s*=\s*/ {print $2}' /etc/audit/auditd.conf | xargs)) -type f \( ! -group adm -a ! -group root \) -exec chgrp adm {} +

Run the following command to configure the audit log files to be owned by the adm group:

# chgrp adm /var/log/audit/

Run the following command to set the log_group parameter in the audit configuration file to log_group = adm :

# sed -ri 's/^\s*#?\s*log_group\s*=\s*\S+(\s*#.*)?.*$/log_group = adm\1/' /etc/audit/auditd.conf

Run the following command to restart the audit daemon to reload the configuration file:

# systemctl restart auditd

See Also

https://workbench.cisecurity.org/benchmarks/18209

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: 3e2c3d8e5f9ebbd2182e3f46a2a0103f089541ca4438b913ddf4e8580306f0da