Verify Permissions on /var/log/messages File

Esta página aún no está disponible en español. Estamos trabajando en su traducción.
Si tienes alguna pregunta o comentario sobre nuestro actual proyecto de traducción, no dudes en ponerte en contacto con nosotros.

Description

To properly set the permissions of /var/log/messages, run the command:

$ sudo chmod 0640 /var/log/messages

Rationale

The /var/log/messages file contains logs of error messages in the system and should only be accessed by authorized personnel.

Remediation

Shell script

The following script can be run on the host to remediate the issue.

#!/bin/bash

chmod u-xs,g-xws,o-xwrt /var/log/messages

Ansible playbook

The following playbook can be run with Ansible to remediate the issue.

- name: Test for existence /var/log/messages
  stat:
    path: /var/log/messages
  register: file_exists
  tags:
  - configure_strategy
  - file_permissions_var_log_messages
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed

- name: Ensure permission u-xs,g-xws,o-xwrt on /var/log/messages
  file:
    path: /var/log/messages
    mode: u-xs,g-xws,o-xwrt
  when: file_exists.stat is defined and file_exists.stat.exists
  tags:
  - configure_strategy
  - file_permissions_var_log_messages
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed