All system audit files must not have extended ACLs.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-22369	GEN002710	SV-38355r2_rule	ECTP-1	Medium

Description
If a user can write to the audit logs, then audit trails can be modified or destroyed and system intrusion may not be detected.

STIG	Date
HP-UX 11.31 Security Technical Implementation Guide	2017-12-08

Details

Check Text ( C-36436r3_chk )
Inspect the auditing configuration file, /etc/rc.config.d/auditing, to determine the filename and path of the audit logs. The entries should appear similar to the following: PRI_AUDFILE=/var/.audit/file1 SEC_AUDFILE=/var/.audit/file2 # egrep “PRI_AUDFILE\|SEC_AUDFILE” /etc/rc.config.d/auditing For each audit log directory/file, check the permissions. # ls -lLd # ls -lLa If any audit log directory/file permissions include a “+”, this is a finding.

Check Text ( C-36436r3_chk )

Inspect the auditing configuration file, /etc/rc.config.d/auditing, to determine the filename and path of the audit logs. The entries should appear similar to the following:
PRI_AUDFILE=/var/.audit/file1
SEC_AUDFILE=/var/.audit/file2

# egrep “PRI_AUDFILE|SEC_AUDFILE” /etc/rc.config.d/auditing

For each audit log directory/file, check the permissions.
# ls -lLd
# ls -lLa

If any audit log directory/file permissions include a “+”, this is a finding.

Fix Text (F-31775r2_fix)
As root, remove the ACL. # chacl -z # chacl -z