4.2.1.3 Ensure rsyslog default file permissions configured

Information

rsyslog will create logfiles that do not already exist on the system. This setting controls what permissions will be applied to these newly created files.

The $FileCreateMode parameter specifies the file creation mode with which rsyslogd creates new files. If not specified, the value 0644 is used.

Notes:

-

The value given must always be a 4-digit octal number, with the initial digit being zero.

-

This setting can be overridden by a less restrictive setting in any file ending inconf in the /etc/rsyslog.d/ directory

It is important to ensure that log files have the correct permissions to ensure that sensitive data is archived and protected.

Solution

Edit the /etc/rsyslog.conf and /etc/rsyslog.d/*.conf files and set $FileCreateMode to 0640 or more restrictive:

$FileCreateMode 0640

See Also

https://workbench.cisecurity.org/benchmarks/8498