cis-ubuntu2004-v300-6-2-4-1

name	cis-ubuntu2004-v300-6-2-4-1
description	Ensure access to all logfiles has been configured
category	cis-logging
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","logging"]
cis_id	6.2.4.1
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

6.2.4.1 Ensure access to all logfiles has been configured (Automated)

Profile

• Level 1 - Server
• Level 1 - Workstation

Description

Log files contain information from many services on the the local system, or in the event of a centralized log server, others systems logs as well.

In general log files are found in /var/log/, although application can be configured to store logs elsewhere. Should your application store logs in another, ensure to run the same test on that location.

Rationale

It is important that log files have the correct permissions to ensure that sensitive data is protected and that only the appropriate users / groups have access to them.

Audit Procedure

Command Line

Run the following script to verify that files in /var/log/ have appropriate permissions and ownership:

#!/usr/bin/env bash
{
    a_output=(); a_output2=()
    f_file_test_chk()
    {
        a_out2=()
        maxperm="$( printf '%o' $(( 0777 & ~$perm_mask )) )"
        [ $(( $l_mode & $perm_mask )) -gt 0 ] && \
            a_out2+=("   o Mode: \"$l_mode\" should be \"$maxperm\" or more restrictive")
        [[ ! "$l_user" =~ $l_auser ]] && \
            a_out2+=("   o Owned by: \"$l_user\" and should be owned by \"${l_auser//|/ or }\"")
        [[ ! "$l_group" =~ $l_agroup ]] && \
            a_out2+=("   o Group owned by: \"$l_group\" and should be group owned by \"${l_agroup//|/ or }\"")
        [ "${#a_out2[@]}" -gt 0 ] && a_output2+=(" - File: \"$l_fname\" is:" "${a_out2[@]}")
    }
    while IFS=  -r -d $ l_file; 
         IFS=:  -r l_fname l_mode l_user l_group; 
            
        
     < <(find -L /var/log - f \( -perm /0137 -o ! -user root -o ! -group root \) -print0)
     [  -le 0 ]; 
        a_output+=()
             
    
              
    
}