Detections
Analytics
RHEL-07-910055 - The Red Hat Enterprise Linux operating system must protect audit information from unauthorized read, modification, or deletion.
Information
If audit information were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve.To ensure the veracity of audit information, the operating system must protect audit information from unauthorized modification.
Audit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit information system activity.
Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029, SRG-OS-000206-GPOS-00084
Solution
Change the mode of the audit log files with the following command:# chmod 0600 [audit_file]
Change the owner and group owner of the audit log files with the following command:
# chown root:root [audit_file]
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RHEL_7_V3R15_STIG.zip
Item Details
Audit Name: DISA Red Hat Enterprise Linux 7 STIG v3r15
Category: AUDIT AND ACCOUNTABILITY, SYSTEM AND INFORMATION INTEGRITY
References: 800-53|AU-9, 800-53|SI-11b., CAT|II, CCI|CCI-000162, CCI|CCI-000163, CCI|CCI-000164, CCI|CCI-001314, Rule-ID|SV-228564r958434_rule, STIG-ID|RHEL-07-910055, Vuln-ID|V-228564
Plugin: Unix
Control ID: c5cf877272d46068a98b1dc65b8ad2296aeb495e073c2ffc90ddbc13810e3edc