Ensure syslog local logging is configured

How it is checked

Audit method: Shell command

out=$(grep -Ev "^[[:blank:]]*(#|$)" /etc/syslog.conf 2>/dev/null) || exit 1; r=compliant; printf '%s\n' "$out" | grep -Eq "(^|;)auth\.info[[:blank:]]+/" || r="auth.info not logged locally"; printf '%s\n' "$out" | grep -Eq "^\*\.info[^[:blank:]]*[[:blank:]]+/" || r="*.info not logged locally"; echo "$r"

Expected output

compliant

How it is fixed

Fix method: Guidance or infrastructure patch

If not already present, explicitly define a log file for the auth.info output in /etc/syslog.conf: printf "auth.info\t\t/var/log/syslog/auth.log rotate time 1d files 30 compress\n" >> /etc/syslog.conf NOTE: This ensures that remote login, sudo or su attempts are logged separately Create the authlog file and make it readable by root only: # /usr/bin/touch /var/log/syslog/auth.log # /usr/bin/chown root:system /var/log/syslog/auth.log # /usr/bin/chmod u=rw,go= /var/log/syslog/auth.log If not already present, create an entry in /etc/syslog.conf to capture all other output of level info or higher, excluding authentication information, as this is to be captured within /var/log/syslog/info.log: printf "*.info;auth.none\t/var/log/syslog/info.log rotate time 1d files 30 compress\n" >> /etc/syslog.conf Create the syslog file: # /usr/bin/touch /var/log/syslog/info.log # /usr/bin/chown root:system /var/log/syslog/info.log # /usr/bin/chmod u=rw,g=r,o= /var/log/syslog/info.log Refresh syslogd to force the daemon to read the edited /etc/syslog.conf: # refresh -s syslogd

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

tmaegis scan --target aix