System Audit Logs Must Have Mode 0750 or Less Permissive
An XCCDF Rule
Description
If log_group in /etc/audit/auditd.conf is set to a group other than the root
group account, change the mode of the audit log files with the following command:
$ sudo chmod 0750 /var/log/audit
Otherwise, change the mode of the audit log files with the following command:
$ sudo chmod 0700 /var/log/audit
Rationale
If users can write to audit logs, audit trails can be modified or destroyed.
- ID
- xccdf_org.ssgproject.content_rule_directory_permissions_var_log_audit
- Severity
- Medium
- References
- Updated