Detections
Analytics
RHEL-09-232103 - RHEL 9 "/etc/audit/" must be owned by root.
Information
The "/etc/audit/" directory contains files that ensure the proper auditing of command execution, privilege escalation, file manipulation, and more. Protection of this directory is critical for system security.Solution
Change the owner of the file "/etc/audit/" to "root" by running the following command:$ sudo chown root /etc/audit/
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RHEL_9_V2R8_STIG.zip
Item Details
Audit Name: DISA Red Hat Enterprise Linux 9 STIG v2r8
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-9, CAT|II, CCI|CCI-000162, Rule-ID|SV-270175r1137691_rule, STIG-ID|RHEL-09-232103, Vuln-ID|V-270175
Plugin: Unix
Control ID: a940c01f17d05a2ac7cf036ec0f9658bf04428c68b450e7f8baa5b4113454ccd