Detections
Analytics

1.126 RHEL-10-400195

Information

RHEL 10 must enforce root ownership of the "/etc/audit/" directory.

GROUP ID: V-281056RULE ID: SV-281056r1165523

The "/etc/audit/" directory contains files that ensure the proper auditing of command execution, privilege escalation, file manipulation, and more. Protection of this directory is critical for system security.

Solution

Configure RHEL 10 so that the "/etc/audit/" directory is owned by "root" with the following command:

$ sudo chown root /etc/audit/

See Also

https://workbench.cisecurity.org/benchmarks/26403

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12b., CAT|II, CCI|CCI-000171, Rule-ID|SV-281056r1165523_rule, STIG-ID|RHEL-10-400195, Vuln-ID|V-281056

Plugin: Unix

Control ID: 715d8c3415091fc9e9516cde25487d3ec6772dc9d3fd735f94070eb85146d69e