Skip to content
ATO Pathways
  Log In

System Audit Logs Must Have Mode 0600 or Less Permissive

An XCCDF Rule

Description

Determine where the audit logs are stored with the following command: 

$ sudo grep -iw log_file /etc/audit/auditd.conf
log_file = /var/log/audit/audit.log
Using the path of the directory containing the audit logs, determine if the audit log files have a mode of "600" or less by using the following command: 
$ sudo stat -c "%n %a" /var/log/audit/*

Rationale

If users can write to audit logs, audit trails can be modified or destroyed.

ID
xccdf_org.ssgproject.content_rule_file_permissions_var_log_audit_stig
Severity
Medium
References
Updated



Remediation - Shell Script

# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}
' 'kernel' 2>/dev/null | grep -q installed && dpkg-query --show --showformat='${db:Status-Status}\n' 'auditd' 2>/dev/null | grep -q installed; then

if LC_ALL=C grep -iqw ^log_file /etc/audit/auditd.conf; then
    FILE=$(awk -F "=" '/^log_file/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')