Check: OSX8-00-00365
Apple OSX 10.8 STIG:
OSX8-00-00365
(in version v1 r2)
Title
The audit log folder must be owned by root:wheel. (Cat II impact)
Discussion
If audit data were to become compromised then competent forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve. To ensure the veracity of audit data the operating system must protect audit information from unauthorized deletion. This requirement can be achieved through multiple methods which will depend upon system architecture and design. Audit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit information system activity.
Check Content
To check the ownership of the audit log files, run the following command: sudo -s ls -dn `sudo grep "^dir" /etc/security/audit_control | awk -F: '{print $2}'`| awk '{ print $3 ":" $4 }' The results should be "0:0". This command shows the UID and GID of the audit logs directory, with the first "0" being root, and the second "0" being wheel. If there is any other result, this is a finding.
Fix Text
If the audit log folder is not owned by root:wheel, run the following command: sudo chown root:wheel /var/audit
Additional Identifiers
Rule ID: SV-65853r1_rule
Vulnerability ID: V-51643
Group Title:
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000164 |
The information system protects audit information from unauthorized deletion. |
Controls
Number | Title |
---|---|
AU-9 |
Protection Of Audit Information |