Ensure audit log files group owner is configured

How it is checked

Audit method: Shell command

alt0() { command -v grep >/dev/null 2>&1 || { echo "step1: grep not installed"; return 1; }; o=$(bash -c 'grep -Piws -- '"'"'^\h*log_group\h*=\h*\H+\b'"'"' /etc/audit/auditd.conf | grep -Pvi -- '"'"'(adm)'"'"'' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; o=$(bash -c '#!/usr/bin/env bash

{
  if [ -e /etc/audit/auditd.conf ]; then
      l_fpath="$(dirname "$(awk -F "=" '"'"'/^\s*log_file/ {print $2}'"'"' /etc/audit/auditd.conf | xargs)")"
      find -L "$l_fpath" -not -path "$l_fpath"/lost+found -type f \( ! -group root -a ! -group adm \) -exec ls -l {} +
   fi
}' 2>&1); [ -z "$o" ] || { echo "step2: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

Run the following command to configure the audit log files to be group owned by adm: # find $(dirname $(awk -F"=" '/^\s*log_file/ {print $2}' /etc/audit/auditd.conf | xargs)) -type f \( ! -group adm -a ! -group root \) -exec chgrp adm {} + Run the following command to set the log_group parameter in the audit configuration file to log_group = adm: # sed -ri 's/^\s*#?\s*log_group\s*=\s*\S+(\s*#.*)?.*$/log_group = adm\1/' /etc/audit/auditd.conf Run the following command to restart the audit daemon to reload the configuration file: # systemctl restart auditd

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target linux --level 2