Detections
Analytics

6.1.2.3 Ensure rsyslog log file creation mode is configured

Information

rsyslog sets the permissions on the log files it creates. The file creation mode is controlled by the fileCreateMode parameter - the modern global(fileCreateMode="...") / omfile-action form or the legacy $FileCreateMode directive - and is further constrained by rsyslog's umask ( global(umask=...) or the legacy $umask ). The value is a four-digit octal mode; if no creation mode is set, rsyslog defaults to 0644. This recommendation governs that creation mode so newly created log files are not world-readable.

Log files routinely contain sensitive event data - usernames, source addresses, service and command detail, and occasionally secrets logged in error. If rsyslog creates log files readable by group or other, any local user can read that data. Constraining the creation mode to 0640 or more restrictive ensures newly created logs are readable only by root (and the log group).

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

- Run the following command to list any existing file-creation-mode directives:

# grep -PHrs -- '^\h*(\$FileCreateMode\b|[^#]*\bfileCreateMode\h*=)' /etc/rsyslog.conf /etc/rsyslog.d/

Remove or correct any $FileCreateMode / fileCreateMode= line more permissive than 0640 so the mode is defined once

 - Create a drop-in file (for example /etc/rsyslog.d/20-file-create-mode.conf ) with the following content, setting the mode to 0640 or more restrictive:

global(fileCreateMode="0640")

 - Run the following command to restart rsyslog :

# systemctl restart rsyslog

The legacy directive $FileCreateMode 0640 is equivalent and remains supported where the modern syntax is not used.

Impact:

Restricting the creation mode removes read access for accounts other than root (and the root/log group); rsyslog runs as root and is unaffected. Because rsyslog's default creation mode is 0644 (world-readable), applying this recommendation changes the permissions of newly created log files on a default system.

See Also

https://workbench.cisecurity.org/benchmarks/27891

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, 800-53|MP-2, CSCv7|5.1, CSCv7|6.2, CSCv7|6.3

Plugin: Unix

Control ID: d995fca587d31c2cbaa235cc9c3cc1ebd9b658ad787c6e38a136334ae284cbf8