mirror of
https://github.com/usnistgov/macos_security.git
synced 2026-02-03 05:53:24 +00:00
40 lines
1.2 KiB
YAML
40 lines
1.2 KiB
YAML
id: audit_acls_files_configure
|
|
title: "Configure Audit Service to Create Log Files and Folder which prevent unauthorized access"
|
|
discussion: |
|
|
Audit information and audit tools must be configured to prevent unauthorized access, modification, and deletion. The audit service must be configured to create log files with the correct permissions to prevent normal users from reading audit logs. If log files are set to be readable and writable only by root or administrative users with sudo, the risk is mitigated.
|
|
|
|
The audit log files must not have access control list (ACL) privileges set.
|
|
check: |
|
|
/bin/ls -le $(/usr/bin/awk -F: '/^dir/{print $2}' /etc/security/audit_control) | /usr/bin/awk '{print $1}' | /usr/bin/grep -c ":"
|
|
result:
|
|
integer: 0
|
|
fix: |
|
|
[source,bash]
|
|
----
|
|
/bin/chmod -RN $(/usr/bin/awk -F: '/^dir/{print $2}' /etc/security/audit_control)
|
|
----
|
|
references:
|
|
cce:
|
|
- CCE-84701-2
|
|
cci:
|
|
- CCI-000162
|
|
- CCI-001314
|
|
800-53r4:
|
|
- AU-9
|
|
- SI-11(b)
|
|
srg:
|
|
- SRG-OS-000057-GPOS-00027
|
|
- SRG-OS-000206-GPOS-00084
|
|
disa_stig:
|
|
- AOSX-14-000030
|
|
macOS:
|
|
- "10.15"
|
|
tags:
|
|
- cnssi-1253
|
|
- fisma-low
|
|
- fisma-moderate
|
|
- fisma-high
|
|
- STIG
|
|
mobileconfig:
|
|
mobileconfig_info:
|