[Linux Audit]: Which groups should be allowed to read audit log files?

quanba · 11-14-2010, 10:20 PM

Hi there,

I am studying about audit log in Unix and reading some security guide.

The guide said that audit log files (/var/log/audit.d) should be owned by groups of which the GIDs should range from 1 - 19.

Can anyone tell me the meaning of the range 1 - 19?

Thanks in advance!

unSpawn · 11-15-2010, 10:09 AM

Quote:

Originally Posted by quanba

Can anyone tell me the meaning of the range 1 - 19?

Traditionally Group Ids between 1 and 500 or 1000 (also see GID_MIN in /etc/login.defs) have been reserved for system users.
Your range should amount to these accounts:

Code:

awk -F: '$3 > 0 && $3 < 20 { print $1 }' /etc/group

of which some are not associated with auditing and writing logs anyway. Kinda makes me wonder what "guide" you're reading.