Ensure only authorized users own audit log files

ÉlevéeNiveau 2Automatiséefreebsd

Description

Audit log files contain information about the system and system activity. Access to audit records can reveal system and configuration data to attackers, potentially compromising its confidentiality. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

Méthode de vérification

Méthode d'audit: Commande shell

shell

command -v find >/dev/null 2>&1 || exit 1; d=$(awk -F: '/^dir:/ {print $2; exit}' /etc/security/audit_control 2>/dev/null); [ -n "$d" ] && [ -d "$d" ] || exit 1; out=$( { find "$d" -type f ! -user root -exec stat -Lf "%N %Su" {} + ; } 2>/dev/null ); [ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 20

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Run the following command to configure the audit log files to be owned by the root user: # [ -f /etc/security/audit_control ] && find "$(awk -F ":" '/^dir/ {print $2}' /etc/security/audit_control | xargs)" -type f ! -user root -exec chown root {} +

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: freebsdaudit
Référence: CIS FreeBSD 14 Benchmark v1.0.1 - 5.2.4.3 Ensure only authorized users own audit log files

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target freebsd --level 2