System audit logs must be group-owned by bin, sys, or system.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22702	GEN002690	SV-38902r1_rule	ECLP-1 ECTP-1	Medium

Description
Sensitive system and user information could provide a malicious user with enough information to penetrate further into the system.

STIG	Date
AIX 5.3 SECURITY TECHNICAL IMPLEMENTATION GUIDE	2014-10-03

Details

Check Text ( C-37246r1_chk )
Procedure: # grep -p bin: /etc/security/audit/config Directories to search will be listed under the bin stanza. # ls -la If any audit log file is not group-owned by bin, sys, or system, this is a finding.

Fix Text (F-33355r1_fix)
Change the group ownership of the audit log file(s). Procedure: # chgrp system < audit log file >