Title

System audit logs must be group-owned by root, bin, or sys. (Cat II impact)

Discussion

Sensitive system and user information could provide a malicious user with enough information to penetrate further into the system.

Check Content

Determine the location of audit logs and then check the group-ownership. Procedure: # more /etc/security/audit_control # ls -lLd <audit log dir> If any audit log file is not group-owned by root, bin, or sys, this is a finding.

Fix Text

Change the group ownership of the audit log file(s). Procedure: # chgrp root <audit log file>

Additional Identifiers

Rule ID: SV-227717r603266_rule

Vulnerability ID: V-227717

Group Title: SRG-OS-000057

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.