V-285665

Discussion

Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality. Audit information includes all information (e.g., audit records, audit settings, audit reports) needed to successfully audit operating system activity. Satisfies: SRG-OS-000057-GPOS-00027, SRG-OS-000058-GPOS-00028, SRG-OS-000059-GPOS-00029

Check Content

Verify audit logs, audit rules, and audit tools are protected from unauthorized access or modification.

1. Access Harvester Government using a privileged account and run:

stat -c "%n %a %U %G" /var/log/audit /var/log/audit/audit.log /etc/audit/audit.rules /etc/audit/rules.d/audit.rules

2. Verify the output shows:

/var/log/audit 600 root root
/var/log/audit/audit.log 600 root root
/etc/audit/audit.rules 640 root root
/etc/audit/rules.d/audit.rules 640 root root

If any file or directory exists and is not owned by root:root, or has permissions more permissive than listed, this is a finding.

3. Verify audit binaries are restricted to authorized users:

stat -c "%n %a %U %G" /usr/sbin/auditctl /usr/sbin/auditd /usr/sbin/ausearch /usr/sbin/aureport /usr/sbin/autrace /usr/sbin/augenrules

4. Verify permissions are no more permissive than:

/usr/sbin/auditctl 750
/usr/sbin/auditd 750
/usr/sbin/ausearch 755
/usr/sbin/aureport 755
/usr/sbin/autrace 750
/usr/sbin/augenrules 750

If any audit tool exists and has permissions more permissive than the approved baseline, this is a finding.