Detections
Analytics

6.3.4.11 Ensure the audit logs are group-owned by root

Information

The operating system's audit logs must be group-owned by root to prevent unauthorized read access.

Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality.

Audit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit the operating system's activity.

Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029

Solution

Configure the audit log to be owned by root by configuring the log group in the /etc/audit/auditd.conf file:

log_group = root

See Also

https://workbench.cisecurity.org/benchmarks/19886

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CAT|II, CSCv7|14.6, Rule-ID|SV-230398r627750_rule, STIG-ID|RHEL-08-030090, Vuln-ID|V-230398

Plugin: Unix

Control ID: 2b69bd7a0144540503d691684c162abe8981217d8747c30faac52b9338f22159