Ensure audit tools group owner is configured

LowLevel 2Automatedlinux

Description

Audit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.

How it is checked

Audit method: Shell command

shell

alt0() { command -v awk >/dev/null 2>&1 || { echo "step1: awk not installed"; return 1; }; command -v stat >/dev/null 2>&1 || { echo "step1: stat not installed"; return 1; }; o=$(bash -c 'stat -Lc "%n %G" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/auditd /sbin/augenrules | awk '"'"'$2 != "root" {print}'"'"'' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Run the following command to change group ownership to the group root: # chgrp root /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/auditd /sbin/augenrules

Properties

Operating systems: sles-16
Tags: cis-convertedlinux
Reference: CIS SUSE Linux Enterprise 16 Benchmark v1.0.0 - 6.2.4.10

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target linux --level 2