Ensure audit configuration files belong to group wheel

MediumLevel 2Automatedfreebsd

Description

Audit configuration files control auditd and what events are audited. Access to the audit configuration files could allow unauthorized personnel to prevent the auditing of critical events. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

How it is checked

Audit method: Shell command

shell

command -v find >/dev/null 2>&1 || exit 1; out=$( { find /etc/security -type f -name 'audit*' ! -group wheel ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Run the following command to change group to wheel: # find /etc/security -type f -name 'audit*' ! -group wheel chgrp wheel {} +

Properties

Operating systems: Any
Tags: freebsdaudit
Reference: CIS FreeBSD 14 Benchmark v1.0.1 - 5.2.4.7 Ensure audit configuration files belong to group wheel

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target freebsd --level 2