Cis Ubuntu2004 V300 6 2 1 2

6.2.1.2 Ensure journald log file access is configured (Manual)

Profile

• Level 1 - Server
• Level 1 - Workstation

Description

Journald will create logfiles that do not already exist on the system. This setting controls what permissions will be applied to these newly created files.

Rationale

It is important to ensure that log files have the correct permissions to ensure that sensitive data is archived and protected.

Audit Procedure

Command Line

Run the following script to verify:

• systemd-journald logfiles are mode 0640 or more restrictive
• Directories /run/ and /var/lib/systemd/ are mode 0755 or more restrictive
• All other configured directories are mode 2755, 0750, or more restrictive

#!/usr/bin/env bash
{
    a_output=() a_output2=()
    l_systemd_config_file="/etc/tmpfiles.d/systemd.conf" l_analyze_cmd="$(readlink -f /bin/systemd-analyze)"
    f_file_chk()
    {
        l_maxperm="$( printf '%o' $(( 0777 & ~$1_perm_mask )) )"
        if [ $(( $l_mode & $l_perm_mask )) -le 0 ] || [[ "$l_type" = "Directory" && "$l_mode" =~ 275{0|5} ]];
    then
            a_out+=(" - $l_type \"$l_logfile\" access is:" \
            "     mode: \"$l_mode\", owned by: \"$l_user\", and group owned by: \"$l_group\"")
        else
            a_out2+=(" - $l_type \"$l_logfile\" access is:" \
            "     mode: \"$l_mode\", owned by: \"$l_user\", and group owned by: \"$l_group\"" \
            "     should be mode: \"$l_maxperm\" or more restrictive")
        fi
    }
    # ... (full audit script from benchmark)
}

Expected Result

Review the output. All files in /var/log/ should have appropriate permissions and ownership.

Remediation

Command Line

If the default configuration is not appropriate for the site specific requirements, copy /usr/lib/tmpfiles.d/systemd.conf to /etc/tmpfiles.d/systemd.conf and modify as required. Recommended mode for logfiles is 0640 or more restrictive.

Default Value

Logfiles are created with mode 0640 by default.

References

1. NIST SP 800-53 Rev. 5: AC-3, AU-2, AU-12, MP-2, SI-5

CIS Controls

MITRE ATT&CK Mappings