UCF STIG Viewer Logo

System audit logs must be group-owned by root, bin, sys, or other.


Overview

Finding ID Version Rule ID IA Controls Severity
V-22702 GEN002690 SV-38406r2_rule ECLP-1 ECTP-1 Medium
Description
Sensitive system and user information could provide a malicious user with enough information to penetrate further into the system.
STIG Date
HP-UX SMSE Security Technical Implementation Guide 2014-02-28

Details

Check Text ( C-36450r2_chk )
Inspect the auditing configuration file, /etc/rc.config.d/auditing, to determine the filename and path of the audit logs. The entries should appear similar to the following:
PRI_AUDFILE=/var/.audit/file1
SEC_AUDFILE=/var/.audit/file2

# egrep “PRI_AUDFILE|SEC_AUDFILE” /etc/rc.config.d/auditing

For each audit log directory/file, check the group ownership.
# ls -lLd
# ls -lLa

If any audit log directory/file is not group-owned by root, bin, sys, or other, this is a finding.
Fix Text (F-31789r2_fix)
As root, change the group ownership.
# chgrp root
# chgrp root