Title

System log files must have mode 644 or less permissive. (Cat II impact)

Discussion

If the system log files are not protected, unauthorized users could change the logged data, eliminating its forensic value.

Check Content

Open a terminal session and enter the following command to verify the permissions. ls -lLR /var/log /var/audit If any of the log files have modes more permissive than 644, this is a finding.

Fix Text

Open a terminal session and enter the following command to change the mode of the system log file(s). chmod 644 <path/to/system log file>

Additional Identifiers

Rule ID: SV-37890r1_rule

Vulnerability ID: V-787

Group Title:

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.