Detections
Analytics
GEN002710 - All system audit files must not have extended ACLs.
Information
If a user can write to the audit logs, then audit trails can be modified or destroyed and system intrusion may not be detected.NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
Remove the extended ACL from the system audit file(s) and disable extended permissions.#acledit <directory>/<file> and disable extended permissions
See Also
https://iasecontent.disa.mil/stigs/zip/U_AIX_6-1_V1R14_STIG.zip
Item Details
Audit Name: DISA STIG AIX 6.1 v1r14
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-9, CAT|II, CCI|CCI-000163, Group-ID|V-22369, Rule-ID|SV-38748r1_rule, STIG-ID|GEN002710, Vuln-ID|V-22369
Plugin: Unix
Control ID: 6393939c93176537ca25104895c05fedc0e1ca0e392e40fbe22fc70b2adb0ea9