TMA-AIX-4.1.2.4
Ensure access on /audit and /etc/security/audit is configured
Description
This recommendation verifies the access control settings for the default locations of AUDIT configuration and output files. The default location for the AUDIT subsystem configuration files are in /etc/security/audit. The default location for output produced by the audit subsystem is the firectory /audit. Access control must prevent unauthorized access. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.
How it is checked
Audit method: Shell command
command -v find >/dev/null 2>&1 || exit 1; out=$( { find /etc/security/audit /audit \( -perm -4 -o -perm -2 -o -perm -1 \) -o ! -user root -o ! -group audit ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Ensure correct ownership and permissions are in place for /etc/security/audit and /audit. #!/usr/bin/ksh -e # Provided to CIS by AIXTools # Copyright AIXTools, 2022 AUDITDIRS="/etc/security/audit /audit" find ${AUDITDIRS} | grep -v 'lost+found' | xargs chown root:audit find ${AUDITDIRS} -type d | grep -v 'lost+found' | xargs chmod g-w,o-rwx find ${AUDITDIRS} ! -type d | grep -v 'lost+found' | xargs chmod -R u-x,g- wx,o-rwx done
Properties
- Operating systems
- Any
- Tags
- aixaudit
- Reference
- CIS IBM AIX 7 Benchmark v1.2.0 - 4.1.2.4 Ensure access on /audit and /etc/security/audit is configured
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target aix