Detections
Analytics

6.1.1.1.4 Ensure journald log file access is configured

Information

Journald will create logfiles that do not already exist on the system. This setting controls what permissions will be applied to these newly created files.

It is important to ensure that log files have the correct permissions to ensure that sensitive data is archived and protected.

Solution

If the default configuration is not appropriate for the site specific requirements, copy /usr/lib/tmpfiles.d/systemd.conf to /etc/tmpfiles.d/systemd.conf and modify as required. Requirements is either 0640 or site policy if that is less restrictive.

Impact:

Restricting journal directory permissions may break tooling that reads log files as a non-root user; audit dependent tooling before applying.

See Also

https://workbench.cisecurity.org/benchmarks/27797

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|AU-2, 800-53|AU-12, 800-53|MP-2, 800-53|SI-5, CSCv7|14.6

Plugin: Unix

Control ID: e3e342f6c4027d1ce3d281a697ff47834107c6486da7024128a6daf4ef96cdca