Skip to content

4.1.4.7 Ensure audit configuration files belong to group root

Audit#

Run the following command to verify that the audit configuration files have mode 640 or more restrictive and are owned by the root user and root group: 

# find /etc/audit/ -type f \( -name '*.conf' -o -name '*.rules' \) ! -group root
Nothing should be returned

Remediation#

Run the following command to change group to root: 

# find /etc/audit/ -type f \( -name '*.conf' -o -name '*.rules' \) ! -group root -exec chgrp root {} +