STIGQter: STIG Summary: Canonical Ubuntu 20.04 LTS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 10 Mar 2021:

The Ubuntu operating system must permit only authorized groups ownership of the audit log files.

DISA Rule

SV-238247r653916_rule

Vulnerability Number

V-238247

Group Title

SRG-OS-000057-GPOS-00027

Rule Version

UBTU-20-010124

Severity

CAT II

CCI(s)

• CCI-000162 - The information system protects audit information from unauthorized access.

Weight

10

Fix Recommendation

Configure the audit log directory and its underlying files to be owned by "adm" group.

Determine where the audit logs are stored with the following command:

$ sudo grep -iw ^log_file /etc/audit/auditd.conf
log_file = /var/log/audit/audit.log

Using the path of the directory containing the audit logs, configure the audit log files to be owned by "adm" group by using the following command:

$ sudo chown :adm /var/log/audit/

Set the "log_group" parameter of the audit configuration file to the "adm" value so that when a new log file is created, its group owner is properly set:

$ sed -i '/^log_group/D' /etc/audit/auditd.conf
$ sed -i /^log_file/a'log_group = adm' /etc/audit/auditd.conf

Last, signal the audit daemon to reload the configuration file:

$ sudo systemctl kill auditd -s SIGHUP"

Check Contents

Verify the group owner is set to own newly created audit logs in the audit configuration file with the following command:

$ sudo grep -iw log_group /etc/audit/auditd.conf
log_group = adm

If the value of the "log_group" parameter is other than "root" or "adm", this is a finding.

Determine where the audit logs are stored with the following command:

$ sudo grep -iw log_file /etc/audit/auditd.conf
log_file = /var/log/audit/audit.log

Using the path of the directory containing the audit logs, determine if the audit log files are owned by the "root" or "adm" group by using the following command:

$ sudo stat -c "%n %G" /var/log/audit/*
/var/log/audit/audit.log root

If the audit log files are owned by a group other than "root" or "adm", this is a finding.

Vulnerability Number

V-238247

Documentable

False

Rule Version

UBTU-20-010124

Severity Override Guidance

Verify the group owner is set to own newly created audit logs in the audit configuration file with the following command:

$ sudo grep -iw log_group /etc/audit/auditd.conf
log_group = adm

If the value of the "log_group" parameter is other than "root" or "adm", this is a finding.

Determine where the audit logs are stored with the following command:

$ sudo grep -iw log_file /etc/audit/auditd.conf
log_file = /var/log/audit/audit.log

Using the path of the directory containing the audit logs, determine if the audit log files are owned by the "root" or "adm" group by using the following command:

$ sudo stat -c "%n %G" /var/log/audit/*
/var/log/audit/audit.log root

If the audit log files are owned by a group other than "root" or "adm", this is a finding.

Check Content Reference

M

Target Key

5318

Comments