Title

Access to audit configuration files must be restricted. (Cat II impact)

Discussion

Audit configuration files are susceptible to unauthorized, and possibly anonymous, tampering if proper permissions are not applied.

Check Content

Open a terminal session and enter the following command to view the permissions on the audit control files. ls -lL /etc/security If any audit control file has a permission less restricted than 555, this is a finding.

Fix Text

Open a terminal session and enter the following command to set the file permissions. chmod 555 /etc/security/ <audit control file>

Additional Identifiers

Rule ID: SV-38570r1_rule

Vulnerability ID: V-25380

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.