STIGQter: STIG Summary: Riverbed NetIM OS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:

Ubuntu OS must configure the files used by the system journal to be group-owned by "systemd-journal".

DISA Rule

SV-275598r1147844_rule

Vulnerability Number

V-275598

Group Title

SRG-OS-000206-GPOS-00084

Rule Version

RIIM-OS-232095

Severity

CAT II

CCI(s)

• CCI-001319 - Takes system components out of service by transferring component responsibilities to a substitute component no later than an organization-defined fraction or percentage of mean time to failure (MTTF).

Weight

10

Fix Recommendation

Configure Ubuntu OS to set the appropriate group-ownership to the files used by the systemd journal:

Add or modify the following line in the "/usr/lib/tmpfiles.d/systemd.conf" file:

Z /run/log/journal/%m ~2640 root systemd-journal - -
z /var/log/journal/%m 2640 root systemd-journal - -
z /var/log/journal/%m/system.journal 0640 root systemd-journal - -

Restart the system for the changes to take effect.

Check Contents

Verify the /run/log/journal and /var/log/journal files are group-owned by "systemd-journal" by using the following command:

$ sudo find /run/log/journal /var/log/journal -type f -exec stat -c "%n %G" {} \;
/var/log/journal/3b018e681c904487b11671b9c1987cce/system@99dcc72bb1134aaeae4bf157aa7606f4-0000000000003c7a-0006073f8d1c0fec.journal systemd-journal
/var/log/journal/3b018e681c904487b11671b9c1987cce/system.journal systemd-journal
/var/log/journal/3b018e681c904487b11671b9c1987cce/user-1000.journal systemd-journal
/var/log/journal/3b018e681c904487b11671b9c1987cce/user-1000@bdedf14602ff4081a77dc7a6debc8626-00000000000062a6-00060b4b414b617a.journal systemd-journal
/var/log/journal/3b018e681c904487b11671b9c1987cce/system@99dcc72bb1134aaeae4bf157aa7606f4-0000000000005301-000609a409
593.journal systemd-journal
/var/log/journal/3b018e681c904487b11671b9c1987cce/system@99dcc72bb1134aaeae4bf157aa7606f4-0000000000000001-000604dae53225ee.journal systemd-journal
/var/log/journal/3b018e681c904487b11671b9c1987cce/user-1000@bdedf14602ff4081a77dc7a6debc8626-000000000000083b-000604dae72c7e3b.journal systemd-journal

If any output returned is not group-owned by "systemd-journal", this is a finding.

Vulnerability Number

V-275598

Documentable

False

Rule Version

RIIM-OS-232095

Severity Override Guidance

Verify the /run/log/journal and /var/log/journal files are group-owned by "systemd-journal" by using the following command:

$ sudo find /run/log/journal /var/log/journal -type f -exec stat -c "%n %G" {} \;
/var/log/journal/3b018e681c904487b11671b9c1987cce/system@99dcc72bb1134aaeae4bf157aa7606f4-0000000000003c7a-0006073f8d1c0fec.journal systemd-journal
/var/log/journal/3b018e681c904487b11671b9c1987cce/system.journal systemd-journal
/var/log/journal/3b018e681c904487b11671b9c1987cce/user-1000.journal systemd-journal
/var/log/journal/3b018e681c904487b11671b9c1987cce/user-1000@bdedf14602ff4081a77dc7a6debc8626-00000000000062a6-00060b4b414b617a.journal systemd-journal
/var/log/journal/3b018e681c904487b11671b9c1987cce/system@99dcc72bb1134aaeae4bf157aa7606f4-0000000000005301-000609a409
593.journal systemd-journal
/var/log/journal/3b018e681c904487b11671b9c1987cce/system@99dcc72bb1134aaeae4bf157aa7606f4-0000000000000001-000604dae53225ee.journal systemd-journal
/var/log/journal/3b018e681c904487b11671b9c1987cce/user-1000@bdedf14602ff4081a77dc7a6debc8626-000000000000083b-000604dae72c7e3b.journal systemd-journal

If any output returned is not group-owned by "systemd-journal", this is a finding.

Check Content Reference

M

Target Key

5706