Skip to content

4.1.4.6 Ensure audit configuration files are owned by root

Audit#

Run the following command to verify that the audit configuration files have mode 640 or more restrictive and are owned by the root user and root group: 

# find /etc/audit/ -type f \( -name '*.conf' -o -name '*.rules' \) ! -user root

Nothing should be returned

Remediation#

Run the following command to change ownership to root user: 

# find /etc/audit/ -type f \( -name '*.conf' -o -name '*.rules' \) ! -user root -exec chown root {} +