Ensure access to rsyslog configuration files is configured

보통레벨 1자동linux

설명

The main rsyslog configuration file /etc/rsyslog.conf and the drop-in configuration files ending in .conf under /etc/rsyslog.d/ control how rsyslog collects, filters, stores, and forwards system log data. These files should be owned by root, group-owned by root, and no more permissive than mode 0640, so that they can be modified only by root and are not readable by any account other than root.

점검 방법

감사 방식: 셸 명령

shell

alt0() { command -v find >/dev/null 2>&1 || { echo "step1: find not installed"; return 1; }; o=$(bash -c 'find /etc/rsyslog.conf -not -type l \( ! -user root -o ! -group root -o - perm /0137 \) 2>/dev/null' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; command -v find >/dev/null 2>&1 || { echo "step2: find not installed"; return 1; }; o=$(bash -c 'find /etc/rsyslog.d/ -type f -name '"'"'*.conf'"'"' \( ! -user root -o ! -group root -o -perm /0137 \) 2>/dev/null' 2>/dev/null); [ -z "$o" ] || { echo "step2: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Run the following commands to set ownership to root:root and remove group write, all access for other accounts, and all execute bits from the rsyslog configuration files, resulting in mode 0640 or more restrictive: # chown root:root /etc/rsyslog.conf # chmod u-x,g-wx,o-rwx /etc/rsyslog.conf # find /etc/rsyslog.d/ -type f -name '*.conf' -exec chown root:root {} + # find /etc/rsyslog.d/ -type f -name '*.conf' -exec chmod u-x,g-wx,o-rwx {} +

속성

운영 체제: rhel-9
태그: cis-convertedlinux
참고 자료: CIS Red Hat Enterprise Linux 9 Benchmark v3.0.0 - 6.1.2.4

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target linux