← Rules Catalog
mediumloggingverified rollback-safe

Restrict ownership of /var/log/syslog

syslog-owner · UBUNTU ≥ 22 · 1 impl

Description

The /var/log/syslog file must be owned by syslog so that only the logging service and root can manage the system log.

Rationale

Correct ownership of the system log prevents unauthorized users from modifying or deleting log records, preserving the integrity of the audit trail.

Check → Remediate

Checkfile_permission
path:
/var/log/syslog
owner:
syslog
Remediatefile_permissions
path:
/var/log/syslog
owner:
syslog

Framework references

STIG

V-270769 / UBTU-24-700140V-260510 / UBTU-22-232130

NIST 800-53

SI-11

Live verification

ubuntu22:checkubuntu24:checkubuntu26:check
#syslog#ownership#logging