Verify Permissions on /var/log/syslog File
Ensure /var/log/syslog is not other-readable, not group/other-writable, and carries no execute, setuid, setgid or sticky bit, protecting the main Debian/Ubuntu system log.
Checked against the content of a persistent configuration file, the source of truth that survives reboots.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
/var/log/syslog is the primary catch-all system log on Debian-family systems and often contains sensitive operational detail (hostnames, service errors, occasionally secrets echoed by misbehaving daemons). If it is other-readable, unprivileged users get a reconnaissance feed; if group/other-writable, they can forge or delete entries to hide an attack. Restricting it to root:adm keeps the log confidential and tamper-resistant.
What Pavois checks
Pavois reads the live inode of /var/log/syslog and asserts no other-read, no group/other-write, and no execute/setuid/setgid/sticky bit. Inspecting the real filesystem object (not /etc/rsyslog.conf) catches a file that drifted to 0644 after a manual edit or a botched rotation, the effective mode is what truly exposes the data.
only_if { file('/var/log/syslog').exist? }
describe file('/var/log/syslog') do
it { should_not be_executable.by('owner') }
it { should_not be_setuid }
it { should_not be_executable.by('group') }
it { should_not be_writable.by('group') }
it { should_not be_setgid }
it { should_not be_executable.by('other') }
it { should_not be_writable.by('other') }
it { should_not be_readable.by('other') }
it { should_not be_sticky }
endHow to verify it is applied
Run stat -c '%A %U:%G' /var/log/syslog. Expect -rw-r----- root:adm (0640), no o read, no group/other write, and no x/s/t bits.
Inspect & investigate
This file is the log; inspect with tail -n 50 /var/log/syslog or journalctl. To detect permission tampering, add auditctl -w /var/log/syslog -p wa and review /var/log/audit/audit.log. Current state: ls -l /var/log/syslog.
Remediation
No automated harden plan ships for this rule, so it must be applied manually: chown root:adm /var/log/syslog and chmod 0640 /var/log/syslog (removing other-read, group/other-write and any execute/special bit).
Pavois applies this with its own harden engine, the plan below, not a shell script:
| mode | 0640 |
|---|---|
| path | /var/log/syslog |
| resource | file |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Loose permissions leak system internals to local users and let logs be rewritten. Precautions: align rsyslog's $FileCreateMode 0640 and the logrotate create 0640 root adm directive (in /etc/logrotate.d/rsyslog), or the next rotation reintroduces the loose mode. Keep group adm readable, log-reading tools and admins in the adm group depend on it; do not tighten to 0600, as that would break that workflow without improving security against root-level threats.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.4.1, 6.2.2.1 | direct | per OS, see the benchmark table | high |
| DISA STIG | UBTU-22-232030, UBTU-24-700150 | direct | per OS STIG release | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.