Detections
Analytics

6.1.1.5 Ensure journald log file access is configured

Information

Journald creates log files that do not already exist on the system. The permissions applied to these newly created files are governed by systemd-tmpfiles directives in /usr/lib/tmpfiles.d/systemd.conf, which an administrator may override in /etc/tmpfiles.d/systemd.conf.

Journal files can contain sensitive information such as usernames, IP addresses, and details of system and user activity. Restricting access to these files to their owner and group prevents unauthorized users from reading that information or tampering with the local log record.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Set the journald log file mode to 0640 (or a more restrictive value per site policy), then correct any existing files.

 - Run the following command to create a local override of the tmpfiles configuration, if it does not already exist, so the change survives package updates:

# [ -f /etc/tmpfiles.d/systemd.conf ] || cp /usr/lib/tmpfiles.d/systemd.conf /etc/tmpfiles.d/systemd.conf

 - Edit /etc/tmpfiles.d/systemd.conf and set the mode field (the third column) of each journald log file directive to 0640 or more restrictive.

Run the following command to apply the updated tmpfiles configuration:

# systemd-tmpfiles --create

Run the following command to correct the mode of any existing journald log files that are looser than 0640 (this removes only the excess permission bits and does not loosen files that are already more restrictive):

# find /var/log/journal /run/log/journal -type f -name '*.journal*' -perm /0137 -exec chmod u-x,g-wx,o-rwx {} +

See Also

https://workbench.cisecurity.org/benchmarks/27893

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

References: 800-53|AC-3, 800-53|AC-6, 800-53|AU-9, CSCv7|14.6

Plugin: Unix

Control ID: 90c84d57556212df2bd1c5d8b99cf9858b307525aa46cebe84a1056d521a6a7f