UCF STIG Viewer Logo

System audit logs must be owned by root.


Overview

Finding ID Version Rule ID IA Controls Severity
V-812 GEN002680 SV-38900r1_rule ECTP-1 Medium
Description
Failure to give ownership of system audit log files to root provides the designated owner and unauthorized users with the potential to access sensitive information.
STIG Date
Draft AIX Security Technical Implementation Guide 2011-08-17

Details

Check Text ( C-37189r1_chk )
Perform the following to determine the location of audit logs and then check the ownership.
Procedure:
# grep -p bin: /etc/security/audit/config
Directories to search will be listed under the bin stanza.
# ls -la
If any audit log file is not owned by root, this is a finding.
Fix Text (F-966r3_fix)
Change the ownership of the audit log file(s).

Procedure:
# chown root