RHEL-06-000135 - All rsyslog-generated log files must have mode 0600 or less permissive.

Information

Log files can contain valuable information regarding system configuration. If the system log files are not protected, unauthorized users could change the logged data, eliminating their forensic value.

Solution

The file permissions for all log files written by rsyslog should be set to 600, or more restrictive. These log files are determined by the second part of each Rule line in '/etc/rsyslog.conf' and typically all appear in '/var/log'. For each log file [LOGFILE] referenced in '/etc/rsyslog.conf', run the following command to inspect the file's permissions:

$ ls -l [LOGFILE]

If the permissions are not 600 or more restrictive, run the following command to correct this:

# chmod 0600 [LOGFILE]

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_RHEL_6_V2R2_STIG.zip

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-11b., CAT|II, CCI|CCI-001314, Rule-ID|SV-217940r603264_rule, STIG-ID|RHEL-06-000135, STIG-Legacy|SV-50424, STIG-Legacy|V-38623, Vuln-ID|V-217940

Plugin: Unix

Control ID: a5e252597c9e0a2e72b9b0efd191e605323f046520d5daffa37f9dbf16d776f4