Detections
Analytics

8.2.1 Ensure syslog local logging is configured

Information

This recommendation implements a local syslog configuration.

Establishing a logging process via syslog provides system and security administrators with pertinent information relating to: login, mail, daemon, user and kernel activity. The recommendation is to enable local syslog logging, with a weekly rotation policy in a four weekly cycle. The log rotation isolates historical data which can be reviewed retrospectively if an issue is uncovered at a later date.

Solution

If not already present, explicitly define a log file for the auth.info output in /etc/syslog.conf :

printf "auth.info\t\t/var/log/syslog/auth.log rotate time 1d files 30 compress\n" >> /etc/syslog.conf

NOTE: This ensures that remote login, sudo or su attempts are logged separately

Create the authlog file and make it readable by root only:

# /usr/bin/touch /var/log/syslog/auth.log
# /usr/bin/chown root:system /var/log/syslog/auth.log
# /usr/bin/chmod u=rw,go= /var/log/syslog/auth.log

If not already present, create an entry in /etc/syslog.conf to capture all other output of level info or higher, excluding authentication information, as this is to be captured within /var/log/syslog/info.log :

printf "*.info;auth.none\t/var/log/syslog/info.log rotate time 1d files 30 compress\n" >> /etc/syslog.conf

Create the syslog file:

# /usr/bin/touch /var/log/syslog/info.log
# /usr/bin/chown root:system /var/log/syslog/info.log
# /usr/bin/chmod u=rw,g=r,o= /var/log/syslog/info.log

Refresh syslogd to force the daemon to read the edited /etc/syslog.conf :

# refresh -s syslogd

Impact:

This recommendation is manual because there are likely local requirements that surpass the basic recommendation here.

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-2

Plugin: Unix

Control ID: 484d00a2bf49a86c548641b798bb1063fa6521561f18564e3e6380bc320ad5d7