TMA-FREEBSD-5.2.4.6
Ensure audit configuration files are owned by root
HighLevel 2Automatedfreebsd
Description
Audit configuration files control auditd and what events are audited. Access to the audit configuration files could allow unauthorized personnel to prevent the auditing of critical events. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.
How it is checked
Audit method: Shell command
shell
command -v find >/dev/null 2>&1 || exit 1; out=$( { find /etc/security -type f -name 'audit*' ! -user root ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
Run the following command to change ownership to root user: # find /etc/security -type f -name 'audit*' -user root -exec chown root {} +
Properties
- Operating systems
- Any
- Tags
- freebsdaudit
- Reference
- CIS FreeBSD 14 Benchmark v1.0.1 - 5.2.4.6 Ensure audit configuration files are owned by root
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
shell
tmaegis scan --target freebsd --level 2