Detections
Analytics

6.1.2.4 Ensure access to rsyslog configuration files is configured

Information

The main rsyslog configuration file /etc/rsyslog.conf and the drop-in configuration files ending in .conf under /etc/rsyslog.d/ control how rsyslog collects, filters, stores, and forwards system log data. These files should be owned by root, group-owned by root, and no more permissive than mode 0640, so that they can be modified only by root and are not readable by any account other than root.

The rsyslog configuration governs which events are recorded and where they are sent. If a non-privileged account can modify these files, it could disable logging of critical events, redirect logs away from a central collector, or alter filters to hide activity, undermining the integrity and availability of the audit trail. Restricting access to root protects the logging configuration from unauthorized tampering and disclosure.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Run the following commands to set ownership to root:root and remove group write, all access for other accounts, and all execute bits from the rsyslog configuration files, resulting in mode 0640 or more restrictive:

# chown root:root /etc/rsyslog.conf
# chmod u-x,g-wx,o-rwx /etc/rsyslog.conf
# find /etc/rsyslog.d/ -type f -name '*.conf' -exec chown root:root {} +
# find /etc/rsyslog.d/ -type f -name '*.conf' -exec chmod u-x,g-wx,o-rwx {} +

Impact:

The recommended mode 0640 removes read access for accounts other than root and the root group; rsyslog runs as root and is unaffected. The rsyslog package ships these files world-readable (mode 0644) by default, so applying this recommendation changes their permissions on a default system. This is consistent with the more restrictive 0640 convention already applied to the audit configuration files in this benchmark.

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: 2ecbdf8d53595954ff7083b0c9334a4dc84df8e733d350fcbc5be0145f48302b