Profile Applicability:
 • Level 2

Description:
The audit log directory stores security and system audit logs. Setting its permissions to 0750 or more restrictive limits access to the directory owner and group, preventing unauthorized users from accessing or modifying audit logs.

Rationale:
 Restricting permissions on the audit log directory protects the confidentiality and integrity of audit data, reducing risks of tampering or unauthorized disclosure.

Impact:
 Pros:

  • Limits access to audit logs to authorized users.

  • Maintains security and trustworthiness of audit records.

Cons:

  • Overly restrictive permissions might interfere with legitimate audit processes.

Default Value:
 Permissions on the audit log directory may vary; verification and adjustment may be necessary.

Pre-requisites:

  • Root or sudo privileges to audit and modify directory permissions.

Remediation:

Test Plan:

Using Linux command line:

Check permissions of the audit log directory:

ls -ld /var/log/audit

  1. Verify permissions are set to 0750 or more restrictive.

Implementation Plan:

Using Linux command line:

Set permissions to 0750 or more restrictive:

chmod 750 /var/log/audit

Verify changes:

ls -ld /var/log/audit

Backout Plan:

Using Linux command line:

  1. Restore previous permissions from backups if necessary.

  2. Verify audit processes continue to function properly.

References: