documentation_complete: true

title: 'Ensure Log Files Are Owned By Appropriate User'

description: |-
    The owner of all log files written by
    <tt>rsyslog</tt> should be root.
    These log files are determined by the second part of each Rule line in
    <tt>/etc/rsyslog.conf</tt> and typically all appear in <tt>/var/log</tt>.
    For each log file <i>LOGFILE</i> referenced in <tt>/etc/rsyslog.conf</tt>,
    run the following command to inspect the file's owner:
    <pre>$ ls -l <i>LOGFILE</i></pre>
    If the owner is not <tt>root</tt>, run the following command to
    correct this:
    <pre>$ sudo chown root <i>LOGFILE</i></pre>

rationale: |-
    The log files generated by rsyslog contain valuable information regarding system
    configuration, user authentication, and other such information. Log files should be
    protected from unauthorized access.

severity: medium

references:
    anssi: NT28(R46),NT28(R5)
    disa: 1314
    nist: AC-6,SI-11
    pcidss: Req-10.5.1,Req-10.5.2

ocil_clause: 'the owner is not root'

ocil: |-
    The owner of all log files written by <tt>rsyslog</tt> should be root.
    These log files are determined by the second part of each Rule line in
    <tt>/etc/rsyslog.conf</tt> and typically all appear in <tt>/var/log</tt>.
    To see the owner of a given log file, run the following command:
    <pre>$ ls -l <i>LOGFILE</i></pre>
