Title

The AIX /etc/syslog.conf file must be owned by root. (Cat II impact)

Discussion

Unauthorized ownership of the /etc/syslog.conf file can lead to the ability for a malicious actor to alter or disrupt system logging activities. This can aid the malicious actor in avoiding detection and further their ability to conduct malicious activities on the system.

Check Content

Check the ownership of /etc/syslog.conf using command: # ls -al /etc/syslog.conf The above command should yield the following output: -rw-r----- 1 root system 993 Mar 11 07:04 /etc/syslog.conf If the file is not owned by root, this is a finding.

Fix Text

Change the ownership of the file to root using command: # chown root /etc/syslog.conf

Additional Identifiers

Rule ID: SV-245561r818803_rule

Vulnerability ID: V-245561

Group Title: SRG-OS-000480-GPOS-00227

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.