In the previous part, Configuring Auditd Rules was completed.
1. CIS Benchmark Requirements (Section 6.3.4)
This article reviews and implements the file and audit tool security requirements defined by the CIS standard:
- 6.3.4.1 Ensure the audit log file directory mode is configured (Automated)
- 6.3.4.2 Ensure audit log files mode is configured (Automated)
- 6.3.4.3 Ensure audit log files owner is configured (Automated)
- 6.3.4.4 Ensure audit log files group owner is configured (Automated)
- 6.3.4.5 Ensure audit configuration files mode is configured (Automated)
- 6.3.4.6 Ensure audit configuration files owner is configured (Automated)
- 6.3.4.7 Ensure audit configuration files group owner is configured (Automated)
- 6.3.4.8 Ensure audit tools mode is configured (Automated)
- 6.3.4.9 Ensure audit tools owner is configured (Automated)
- 6.3.4.10 Ensure audit tools group owner is configured (Automated)
2. Concept and Rationale
Audit logs, auditd configuration files, and related tools contain highly sensitive information about system events, processes, and login attempts. If an attacker or unauthorized user gains access to these files, they may obtain valuable information for further exploitation. Furthermore, if they can modify or delete the files, they may be able to conceal their activities. Therefore, precisely restricting ownership to root:root and limiting the permissions of these files and tools is a critical security requirement.
3. Oracle Database Compatibility Review (RAC and Grid)
Applying these restrictions to the /var/log/audit directory, /etc/audit/ files, and system utilities such as auditctl does not interfere with the operation of Oracle Database or Oracle Grid Infrastructure. Oracle stores its own audit logs in separate locations, such as the adump directory within the $ORACLE_BASE structure. Database processes owned by the oracle or grid users do not require access to read or modify the operating system audit logs or audit tools.
4. Auditing the Current Configuration
The following script checks the ownership and permission settings of the audit log directory, log files, configuration files, and audit tools.
The path of this script in GitHub is: modules/audit_27_Auditd_File_Access.sh
If you are not familiar with Bash scripting, you may refer to the training published for database administrators: Bash for Oracle DBAs.
#!/bin/bash
# Script: audit27.sh
# Purpose: Audit permissions and ownership of auditd files and tools (CIS 6.3.4)
echo "=========================================================================="
echo " CIS Requirement: Auditd File Access (CIS 6.3.4)"
echo " - Ensure /var/log/audit is 0750 or 0700"
echo " - Ensure log files and config files are 0640 or 0600, owned by root"
echo " - Ensure audit tools are securely configured"
echo "=========================================================================="
AUDIT_STATUS="PASS"
check_perms() {
local desc="$1"
local result="$2"
if [ -z "$result" ]; then
echo "[PASS] $desc"
else
echo "[FAIL] $desc"
echo "$result" | sed 's/^/ -> /'
AUDIT_STATUS="FAIL"
fi
}
# 1. Directory mode
RES=$(stat -c "%n - %a" /var/log/audit 2>/dev/null | grep -vE "(750|700)")
check_perms "/var/log/audit directory mode" "$RES"
# 2. Log files
RES=$(find /var/log/audit -type f \( ! -perm 0600 -a ! -perm 0640 \) 2>/dev/null)
check_perms "/var/log/audit files mode (0600/0640)" "$RES"
RES=$(find /var/log/audit -type f \( ! -user root -o ! -group root \) 2>/dev/null)
check_perms "/var/log/audit files ownership (root:root)" "$RES"
# 3. Configuration files
RES=$(find /etc/audit -type f \( ! -perm 0640 -a ! -perm 0600 \) 2>/dev/null)
check_perms "/etc/audit config files mode (0640/0600)" "$RES"
RES=$(find /etc/audit -type f \( ! -user root -o ! -group root \) 2>/dev/null)
check_perms "/etc/audit config files ownership (root:root)" "$RES"
# 4. Audit tools
TOOLS=(
"/sbin/auditctl"
"/sbin/aureport"
"/sbin/ausearch"
"/sbin/autrace"
"/sbin/auditd"
"/sbin/augenrules"
)
TOOL_FAIL=""
for tool in "${TOOLS[@]}"; do
if [ -e "$tool" ]; then
MODE=$(stat -c "%a" "$tool")
OWNER=$(stat -c "%U:%G" "$tool")
if [[ ! "$MODE" =~ ^(755|750)$ ]] || [[ "$OWNER" != "root:root" ]]; then
TOOL_FAIL="${TOOL_FAIL}${tool} (Mode:${MODE}, Owner:${OWNER})\n"
fi
fi
done
check_perms \
"Audit tools permissions and ownership" \
"$(echo -e "$TOOL_FAIL" | sed '/^$/d')"
echo "--------------------------------------------------------------------------"
if [ "$AUDIT_STATUS" = "PASS" ]; then
echo " Final Audit Status: PASS"
else
echo " Final Audit Status: FAIL"
fi
echo "=========================================================================="5. Applying the Configuration (Remediation Bash Script)
The following script corrects the permissions and ownership settings according to the CIS requirements.
The path of this script in GitHub is: modules/remediate_27_Auditd_File_Access.sh
#!/bin/bash
# Script: remediate_cis_6_3_4.sh
# Purpose: Fix permissions and ownership for auditd files and tools
if [ "$EUID" -ne 0 ]; then
echo "Please run as root"
exit 1
fi
echo -e "\n[+] Remediating CIS 6.3.4..."
# 6.3.4.1 - 6.3.4.4: Log directory and log files
echo "[*] Securing /var/log/audit and log files..."
if [ -d /var/log/audit ]; then
chown root:root /var/log/audit
chmod 0750 /var/log/audit
find /var/log/audit -type f -exec chmod 0640 {} \;
find /var/log/audit -type f -exec chown root:root {} \;
fi
# 6.3.4.5 - 6.3.4.7: Configuration files
echo "[*] Securing /etc/audit/ configuration files..."
if [ -d /etc/audit ]; then
find /etc/audit -type f -exec chown root:root {} \;
find /etc/audit -type f -exec chmod 0640 {} \;
fi
if [ -f /etc/audit/auditd.conf ]; then
chown root:root /etc/audit/auditd.conf
chmod 0640 /etc/audit/auditd.conf
fi
# 6.3.4.8 - 6.3.4.10: Audit tools
echo "[*] Securing audit tools..."
TOOLS=(
"/sbin/auditctl"
"/sbin/aureport"
"/sbin/ausearch"
"/sbin/autrace"
"/sbin/auditd"
"/sbin/augenrules"
)
for tool in "${TOOLS[@]}"; do
if [ -e "$tool" ]; then
chown root:root "$tool"
chmod 0755 "$tool"
fi
done
echo "[+] Remediation applied successfully."In the next part, we will cover Managing System File Access .