Ensure access to rsyslog configuration files is configured

SedangLevel 1Otomatislinux

Deskripsi

The main rsyslog configuration file /etc/rsyslog.conf and the drop-in configuration files ending in .conf under /etc/rsyslog.d/ control how rsyslog collects, filters, stores, and forwards system log data. These files should be owned by root, group-owned by root, and no more permissive than mode 0640, so that they can be modified only by root and are not readable by any account other than root.

Cara pemeriksaan

Metode audit: Perintah shell

shell

alt0() { command -v find >/dev/null 2>&1 || { echo "step1: find not installed"; return 1; }; o=$(bash -c 'find /etc/rsyslog.conf -not -type l \( ! -user root -o ! -group root -o - perm /0137 \) 2>/dev/null' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; command -v find >/dev/null 2>&1 || { echo "step2: find not installed"; return 1; }; o=$(bash -c 'find /etc/rsyslog.d/ -type f -name '"'"'*.conf'"'"' \( ! -user root -o ! -group root -o -perm /0137 \) 2>/dev/null' 2>/dev/null); [ -z "$o" ] || { echo "step2: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

Run the following commands to set ownership to root:root and remove group write, all access for other accounts, and all execute bits from the rsyslog configuration files, resulting in mode 0640 or more restrictive: # chown root:root /etc/rsyslog.conf # chmod u-x,g-wx,o-rwx /etc/rsyslog.conf # find /etc/rsyslog.d/ -type f -name '*.conf' -exec chown root:root {} + # find /etc/rsyslog.d/ -type f -name '*.conf' -exec chmod u-x,g-wx,o-rwx {} +

Properti

Sistem operasi: rocky-9
Tag: cis-convertedlinux
Referensi: CIS Rocky Linux 9 Benchmark v3.0.0 - 6.1.2.4

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target linux