Verify User Who Owns /var/log/syslog File
Ensures the main system log /var/log/syslog is owned by root.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/var/log/syslog is the main catch-all system log on Debian/Ubuntu, aggregating messages from the kernel, services and daemons. If it is not owned by root, an unprivileged or compromised process could read operational details or alter and delete entries, hiding faults or the activity of an attacker and crippling forensic analysis.
What Pavois checks
Pavois checks that the owner of /var/log/syslog is root, only when the file exists (only_if). It reads the live owner (stat) on the target rather than a logrotate/packaging default, so a chown introduced by rotation or a deployment script is caught as the effective on-disk state.
only_if { file('/var/log/syslog').exist? }
describe command("stat -c %U /var/log/syslog 2>/dev/null") do
its('stdout.strip') { should be_in ['root', 'syslog'] }
endHow to verify it is applied
Confirm the owner with:
stat -c '%U' /var/log/syslog
Expected output is root.
Inspect & investigate
This file is itself the main system log. Inspect ownership and content:
ls -l /var/log/syslog
tail -n 50 /var/log/syslog
The writer is rsyslog (systemctl status rsyslog). Ownership changes can be tracked with grep 'syslog' /var/log/audit/audit.log if auditd watches are configured.
Remediation
Pavois's harden plan uses a file resource to set the owner of /var/log/syslog to root. Run pavois harden apply to enforce it, the Chef engine performs the equivalent of chown root /var/log/syslog, leaving content and group untouched.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| command | chown root /var/log/syslog 2>/dev/null; true |
|---|---|
| name | log-owner-var-log-syslog |
| not_if | stat -c %U /var/log/syslog 2>/dev/null | grep -qxE 'root|syslog' |
| path | /var/log/syslog |
| resource | exec |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Consequences if misconfigured: a non-root owner can read operational data or tamper with the main system log, hiding faults or an attacker's tracks.
Precautions before applying: re-owning to root is safe, on Debian/Ubuntu, rsyslog writes /var/log/syslog with root as owner (and group adm) by default, so the fix matches the expected runtime owner and does not interrupt logging. The group is preserved by the remediation, keeping adm-based read access intact. The only_if guard skips hosts lacking the file (e.g. journald-only systems).
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.4.1, 6.2.2.1 | direct | per OS, see the benchmark table | high |
| DISA STIG | UBTU-22-232130, UBTU-24-700140 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.