mediumauditverified ✓
Ensure audit tools group owner is configured
audit-tools-group · RHEL ≥ 8, UBUNTU ≥ 22 · 1 impl
Description
Audit tool binaries must be group-owned by root.
Rationale
Incorrect ownership or permissions on audit files could allow unauthorized users to tamper with audit evidence.
Check → Remediate
Checkcommand
find /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/rsyslogd /sbin/augenrules -type f ! -group root 2>/dev/null | head -1
- expected_exit:
- 0
Remediatecommand_exec
chgrp root /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/rsyslogd /sbin/augenrules
Framework references
CIS
rhel9 6.3.4.10rhel10 6.3.4.10ubuntu24 6.2.4.10ubuntu22 6.2.4.10rhel8 6.3.4.10
STIG
V-281078 / RHEL-10-400305V-257925 / RHEL-09-232225V-230474V-270823 / UBTU-24-901250
NIST 800-53
AU-9AC-6
Live verification
rhel10:checkrhel8:checkrhel9:checkubuntu22:checkubuntu24:check
#audit#permissions