mediumfilesystemverified ✓

Restrict permissions on system log files under /var/log

var-log-files-permissions · UBUNTU ≥ 22 · 1 impl

Description

All system log files under /var/log must have a mode of 0640 or less permissive so that unauthorized users cannot read or modify recorded security-relevant events. The btmp, wtmp, and lastlog login-accounting files are excluded, as they legitimately carry group access for accounting.

Rationale

System log files contain security-relevant information that can reveal attack vectors, user activity, and system state. Overly permissive log files let unauthorized users read sensitive operational detail or tamper with the audit trail, undermining accountability.

Check → Remediate

Checkcommand

find /var/log -perm /137 ! -name '*[bw]tmp' ! -name '*lastlog' ! -name '*.history' ! -name 'eipp.log.xz' -type f 2>/dev/null | head -1 | grep -q . && exit 1 || exit 0

expected_exit:: 0

Remediatemanual

note:: Set each offending file to 0640 or less permissive, e.g.: find /var/log -perm /137 ! -name '*[bw]tmp' ! -name '*lastlog' ! -name '*.history' ! -name 'eipp.log.xz' -type f -exec chmod 640 {} \;

Framework references

STIG

V-270756 / UBTU-24-700010V-260489 / UBTU-22-232026

NIST 800-53

SI-11AC-6

Live verification

ubuntu22:checkubuntu24:check

#logging#permissions#var-log#stig