← Back to Nutanix AOS 5.20.x OS Security Technical Implementation Guide

V-254184

CAT II (Medium)

Nutanix AOS audit tools must be configured to 0755 or less permissive.

Rule ID

SV-254184r991557_rule

STIG

Nutanix AOS 5.20.x OS Security Technical Implementation Guide

Version

V1R2

CCIs

CCI-001493

Discussion

Without information that establishes the identity of the subjects (i.e., users or processes acting on behalf of users) associated with the events, security personnel cannot determine responsibility for the potentially harmful event.

Check Content

Verify the audit tools are protected from unauthorized access, deletion, or modification by checking the permissive mode.

Check the octal permission of each audit tool by running the following command:
$ sudo stat -c "%a %n" /sbin/auditctl /sbin/aureport /sbin/ausearch /sbin/autrace /sbin/auditd /sbin/rsyslogd /sbin/augenrules
750 /sbin/auditctl
750 /sbin/aureport
750 /sbin/ausearch
750 /sbin/autrace
750 /sbin/auditd
755 /sbin/rsyslogd
755 /sbin/augenrules

If any of the audit tools has a mode more permissive than "0755", this is a finding.

Fix Text

Configure the audit tools to be protected from unauthorized access by setting the correct permissive mode using the following command:

$ sudo chmod 0755 [audit_tool]

Replace "[audit_tool]" with the audit tool that does not have the correct permissive mode.