Ensure access to rsyslog configuration files is configured

中级别 1自动化linux

说明

The main rsyslog configuration file /etc/rsyslog.conf and the drop-in configuration files ending in .conf under /etc/rsyslog.d/ control how rsyslog collects, filters, stores, and forwards system log data. These files should be owned by root, group-owned by root, and no more permissive than mode 0640, so that they can be modified only by root and are not readable by any account other than root.

检查方式

审计方法: Shell 命令

shell

alt0() { command -v find >/dev/null 2>&1 || { echo "step1: find not installed"; return 1; }; o=$(bash -c 'find /etc/rsyslog.conf -not -type l \( ! -user root -o ! -group root -o - perm /0137 \) 2>/dev/null' 2>/dev/null); [ -z "$o" ] || { echo "step1: $o" | head -c 300; return 1; }; command -v find >/dev/null 2>&1 || { echo "step2: find not installed"; return 1; }; o=$(bash -c 'find /etc/rsyslog.d/ -type f -name '"'"'*.conf'"'"' \( ! -user root -o ! -group root -o -perm /0137 \) 2>/dev/null' 2>/dev/null); [ -z "$o" ] || { echo "step2: $o" | head -c 300; return 1; }; }; if alt0; then echo compliant; fi

预期输出: compliant

修复方式

修复方法: 操作指南或基础设施补丁

Run the following commands to set ownership to root:root and remove group write, all access for other accounts, and all execute bits from the rsyslog configuration files, resulting in mode 0640 or more restrictive: # chown root:root /etc/rsyslog.conf # chmod u-x,g-wx,o-rwx /etc/rsyslog.conf # find /etc/rsyslog.d/ -type f -name '*.conf' -exec chown root:root {} + # find /etc/rsyslog.d/ -type f -name '*.conf' -exec chmod u-x,g-wx,o-rwx {} +

属性

操作系统: rocky-9
标签: cis-convertedlinux
参考: CIS Rocky Linux 9 Benchmark v3.0.0 - 6.1.2.4

检查本机

请在您有权审计的机器上运行此命令。扫描为只读操作。

shell

tmaegis scan --target linux