Navigate

Check: GEN002716

Solaris 10 X86 STIG: GEN002716 (in versions v2 r4 through v1 r17)

Title

System audit tool executables must be group-owned by root, bin, or sys. (Cat III impact)

Discussion

To prevent unauthorized access or manipulation of system audit logs, the tools for manipulating those logs must be protected.

Check Content

Verify the audit tool executables are group-owned by root, bin, or sys. Procedure: # ls -lL /usr/sbin/auditd /usr/sbin/audit /usr/sbin/bsmrecord /usr/sbin/auditreduce /usr/sbin/praudit /usr/sbin/auditconfig If any listed file is not group-owned by root, bin, or sys, this is a finding.

Fix Text

Change the group-owner of the audit tool executable to root, bin, or sys. Procedure: # chgrp root <audit tool executable>

Additional Identifiers

Rule ID: SV-227721r603266_rule

Vulnerability ID: V-227721

Group Title: SRG-OS-000256

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-001493	The information system protects audit tools from unauthorized access.

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
AU-9	Protection Of Audit Information