System Audit Logs Must Have Mode 0640 or Less Permissive

Description

Determine where the audit logs are stored with the following command:

$ sudo grep -iw log_file /etc/audit/auditd.conf
log_file = /var/log/audit/audit.log

Configure the audit log to be protected from unauthorized read access by setting the correct permissive mode with the following command:

$ sudo chmod 0600 audit_log_file

By default, audit_log_file is "/var/log/audit/audit.log".

Rationale

If users can write to audit logs, audit trails can be modified or destroyed.