SV-261308r996395_rule
V-261308
SRG-OS-000206-GPOS-00084
SLEM-05-232115
CAT II
10
Configure SLEM 5 to prevent unauthorized users from accessing system error messages.
Add or update the following rules in "/etc/permissions.local":
/var/log/messages root:root 640
Set the correct permissions with the following command:
> sudo chkstat --set --system
Verify SLEM 5 prevents unauthorized users from accessing system error messages.
Check the "/var/log/messages" file permissions with the following command:
> sudo stat -c "%n %U:%G %a" /var/log/messages
/var/log/messages root:root 640
Check that "permissions.local" file contains the correct permissions rules with the following command:
> grep -i messages /etc/permissions.local
/var/log/messages root:root 640
If the effective permissions do not match the "permissions.local" file, the command does not return any output, or is commented out, this is a finding.
V-261308
False
SLEM-05-232115
Verify SLEM 5 prevents unauthorized users from accessing system error messages.
Check the "/var/log/messages" file permissions with the following command:
> sudo stat -c "%n %U:%G %a" /var/log/messages
/var/log/messages root:root 640
Check that "permissions.local" file contains the correct permissions rules with the following command:
> grep -i messages /etc/permissions.local
/var/log/messages root:root 640
If the effective permissions do not match the "permissions.local" file, the command does not return any output, or is commented out, this is a finding.
M
5596