SV-270756r1134814_rule
V-270756
SRG-OS-000205-GPOS-00083
UBTU-24-700010
CAT II
10
Configure Ubuntu 24.04 LTS to set permissions of all log files under the /var/log directory to "640" or more restricted by using the following command:
Note: The btmp, wtmp, lastlog, history, and eipp.log.xz files are excluded. Refer to the Discussion for details.
$ sudo find /var/log -perm /137 ! -name '*[bw]tmp' ! -name '*lastlog' -type f -exec chmod 640 '{}' \;
Verify Ubuntu 24.04 LTS has all system log files under the /var/log directory with a permission set to "640" or less permissive with the following command:
Note: The btmp, wtmp, lastlog, history, and eipp.log.xz files are excluded from this check. Refer to the Discussion for details.
$ sudo find /var/log -perm /137 ! -name '*[bw]tmp' ! -name '*lastlog' -type f -exec stat -c "%n %a" {} \;
If the command displays any output, this is a finding.
V-270756
False
UBTU-24-700010
Verify Ubuntu 24.04 LTS has all system log files under the /var/log directory with a permission set to "640" or less permissive with the following command:
Note: The btmp, wtmp, lastlog, history, and eipp.log.xz files are excluded from this check. Refer to the Discussion for details.
$ sudo find /var/log -perm /137 ! -name '*[bw]tmp' ! -name '*lastlog' -type f -exec stat -c "%n %a" {} \;
If the command displays any output, this is a finding.
M
5673