Detections
Analytics

1.127 RHEL-10-400200

Information

RHEL 10 must enforce root group ownership of the "/etc/audit/" directory.

GROUP ID: V-281057RULE ID: SV-281057r1165526

The "/etc/audit/" directory contains files that ensure the proper auditing of command execution, privilege escalation, file manipulation, and more. Protection of this directory is critical for system security.

Solution

Configure RHEL 10 so that the "/etc/audit/" directory is group-owned by "root" with the following command:

$ sudo chgrp root /etc/audit/

See Also

https://workbench.cisecurity.org/benchmarks/26403

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12b., CAT|II, CCI|CCI-000171, Rule-ID|SV-281057r1165526_rule, STIG-ID|RHEL-10-400200, Vuln-ID|V-281057

Plugin: Unix

Control ID: 9f4c01ed98c867fc05ebb72023e19c7fa5f4e22629087238e548f566a2576fd9