Detections
Analytics
AIX7-00-002145 - The AIX /etc/syslog.conf file must be group-owned by system.
Information
Unauthorized group ownership of the /etc/syslog.conf file can lead to the ability for a malicious actor to alter or disrupt system logging activities. This can aid the malicious actor in avoiding detection and further their ability to conduct malicious activities on the system.Solution
Change the group ownership of the file to system using command:# chgrp system /etc/syslog.conf
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_IBM_AIX_7-x_V3R3_STIG.zip
Item Details
Audit Name: DISA IBM AIX 7.x STIG v3r3
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-245562r991589_rule, STIG-ID|AIX7-00-002145, Vuln-ID|V-245562
Plugin: Unix
Control ID: 907552aad855994891b69f6215edc3675802f674f3f41ae94dc1b3966c6ceddd