Skip to content
ATO Pathways
  Log In

System Audit Logs Must Have Mode 0750 or Less Permissive

An XCCDF Rule

Description

Verify the audit log directories have a mode of "0700" or less permissive by first determining where the audit logs are stored with the following command: 

$ sudo grep -iw log_file /etc/audit/auditd.conf

log_file = /var/log/audit/audit.log
Configure the audit log directory to be protected from unauthorized read access by setting the correct permissive mode with the following command: 
$ sudo chmod 0700 audit_log_directory
By default, audit_log_directory is "/var/log/audit".

Rationale

If users can write to audit logs, audit trails can be modified or destroyed.

ID
xccdf_org.ssgproject.content_rule_directory_permissions_var_log_audit
Severity
Medium
References
Updated



Remediation - Shell Script

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ] && rpm --quiet -q audit; then

if LC_ALL=C grep -iw ^log_file /etc/audit/auditd.conf; then
  DIR=$(awk -F "=" '/^log_file/ {print $2}' /etc/audit/auditd.conf | tr -d ' ' | rev | cut -d"/" -f2- | rev)
else