The AIX /etc/syslog.conf file must be group-owned by system. (Cat II impact)
Unauthorized group ownership of the /etc/syslog.conf file can lead to the ability for a malicious actor to alter or disrupt system logging activities. This can aid the malicious actor in avoiding detection and further their ability to conduct malicious activities on the system.
Check the group ownership of /etc/syslog.conf using command: # ls -al /etc/syslog.conf The above command should yield the following output: -rw-r----- 1 root system 993 Mar 11 07:04 /etc/syslog.conf If the file is not group-owned by system, this is a finding.
Change the group ownership of the file to system using command: # chgrp system /etc/syslog.conf
Rule ID: SV-245562r818806_rule
Vulnerability ID: V-245562
Group Title: SRG-OS-000480-GPOS-00227
The organization implements the security configuration settings.