Detections
Analytics

6.1.2.5 Ensure access to the /etc/rsyslog.d directory is configured

Information

The /etc/rsyslog.d/ directory holds drop-in rsyslog configuration files ending in .conf. The directory should be owned by root, group-owned by root, and not writable by any account other than root so that unauthorized users cannot add, remove, or replace rsyslog configuration fragments.

Because rsyslog reads every .conf file in /etc/rsyslog.d/, an account able to write to this directory could introduce a new configuration fragment that disables logging, changes filters, or redirects log forwarding, without altering any existing file. Restricting write access to the directory to root prevents unauthorized modification of the effective logging configuration.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Run the following commands to set ownership to root:root and remove group and other write from the directory:

# chown root:root /etc/rsyslog.d
# chmod g-w,o-w /etc/rsyslog.d

Impact:

None. The recommended ownership and permissions match the rsyslog package default (0755 root:root), so applying this recommendation does not change default system behavior.

See Also

https://workbench.cisecurity.org/benchmarks/27893

Item Details

Category: ACCESS CONTROL, MEDIA PROTECTION

References: 800-53|AC-3, 800-53|AC-5, 800-53|AC-6, 800-53|MP-2, CSCv7|14.6

Plugin: Unix

Control ID: c0bcf4df0cb12cc3e4097c731b0bdca635b4f7bc45d83f978d2ee8890040c449