Title

System audit logs must be owned by root. (Cat II impact)

Discussion

Failure to give ownership of system audit log files to root provides the designated owner and unauthorized users with the potential to access sensitive information.

Check Content

Open a terminal session and use the following command to verify the owner of audit logs in the /var/audit directory. ls -lL /var/audit If any file in the /var/audit directory is not owned by root, this is a finding.

Fix Text

Open a terminal session and use the following command to change the owner of the file. chown root /var/audit/<filename>

Additional Identifiers

Rule ID: SV-38619r1_rule

Vulnerability ID: V-812

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.