System Audit Logs Must Be Owned By Root
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。
翻訳に関してご質問やご意見ございましたら、
お気軽にご連絡ください。
All audit logs must be owned by root user. The path for audit log can be
configured via log_file parameter in
or by default, the path for audit log is
.
To properly set the owner of /var/log/audit/*, run the command:
$ sudo chown root /var/log/audit/*
Unauthorized disclosure of audit records can reveal system and configuration data to
attackers, thus compromising its confidentiality.
The following script can be run on the host to remediate the issue.
#!/bin/bash
# Remediation is applicable only in certain platforms
if dpkg-query --show --showformat='${db:Status-Status}
' 'kernel' 2>/dev/null | grep -q installed && dpkg-query --show --showformat='${db:Status-Status}\n' 'auditd' 2>/dev/null | grep -q installed; then
if LC_ALL=C grep -iw log_file /etc/audit/auditd.conf; then
FILE=$(awk -F "=" '/^log_file/ {print $2}' /etc/audit/auditd.conf | tr -d ' ')
chown root $FILE*
else
chown root /var/log/audit/audit.log*
fi
else
>&2 echo 'Remediation is not applicable, nothing was done'
fi
