Detections
Analytics

6.3.4.5 Ensure audit configuration files mode is configured

Information

Audit configuration files control auditd and what events are audited.

Access to the audit configuration files could allow unauthorized personnel to prevent the auditing of critical events.

Misconfigured audit configuration files may prevent the auditing of critical events or impact the system's performance by overwhelming the audit log. Misconfiguration of the audit configuration files may also make it more difficult to establish and investigate events relating to an incident.

Solution

Run the following command to remove more permissive mode than 0640 from the audit configuration files:

# find /etc/audit/ -type f \( -name '*.conf' -o -name '*.rules' \) -exec chmod u-x,g-wx,o-rwx {} +

See Also

https://workbench.cisecurity.org/benchmarks/19886

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|AU-12b., 800-53|MP-2, CAT|II, CSCv7|14.6, Rule-ID|SV-230471r627750_rule, STIG-ID|RHEL-08-030610, Vuln-ID|V-230471

Plugin: Unix

Control ID: 4d10b28d466941b0782f8a5c13f216384fbe389de2492b4ae11fca4a6a83916d