Verify Group Who Owns /var/log/syslog File
Ensures the /var/log/syslog system log is group-owned by gid 4 (adm).
Checked against a path’s metadata, mode, owner, group, SUID/SGID.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
On Debian/Ubuntu /var/log/syslog is the primary catch-all system log. It must be group-owned by gid 4 (adm) so only authorized personnel can read it. The file aggregates kernel, daemon and error events that disclose hostnames, IPs, service versions and error traces, reconnaissance gold for an attacker, and a tampering target if writable by the wrong users.
What Pavois checks
Pavois reads the effective owning gid with the InSpec file resource and asserts it equals 4 (the adm group on Debian/Ubuntu), only when the file exists. Checking the live filesystem metadata reflects the permissions the kernel enforces now, catching drift from log rotation or manual changes that a static config/package scan cannot detect.
only_if { file('/var/log/syslog').exist? }
describe file('/var/log/syslog') do
its('gid') { should eq 4 }
endHow to verify it is applied
Run stat -c '%g %G' /var/log/syslog. Expected output: 4 adm. Alternatively ls -l /var/log/syslog should show adm in the group column.
Inspect & investigate
Ownership is shown by ls -l /var/log/syslog and stat /var/log/syslog. The file is produced by rsyslog, check systemctl status rsyslog and journalctl -u rsyslog, and its rotation policy in /etc/logrotate.d/rsyslog. If auditd watches /var/log, chgrp/chown syscalls appear in /var/log/audit/audit.log.
Remediation
No automated harden plan is shipped for this rule, so it must be remediated manually: run chgrp adm /var/log/syslog (and the rotated copies, e.g. chgrp adm /var/log/syslog.*). Confirm /etc/logrotate.d/rsyslog recreates the file with the adm group so the fix survives rotation.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| group | adm |
|---|---|
| path | /var/log/syslog |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
An incorrect owning group exposes the main system log to unprivileged users for reconnaissance or tampering. Restoring gid 4 (adm) is safe for normal operation since rsyslog writes as root. Precaution: verify any log-shipping or monitoring agent reads the file as root or via adm; add it to adm first if needed so it does not lose read access.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.4.1, 6.2.2.1 | direct | per OS, see the benchmark table | high |
| DISA STIG | UBTU-22-232135, UBTU-24-700130 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.