← Back to IBM AIX 7.x Security Technical Implementation Guide

V-245563

CAT II (Medium)

The AIX /etc/syslog.conf file must have a mode of 0640 or less permissive.

Rule ID

SV-245563r991589_rule

STIG

IBM AIX 7.x Security Technical Implementation Guide

Version

V3R2

CCIs

CCI-000366

Discussion

Unauthorized permissions of the /etc/syslog.conf file can lead to the ability for a malicious actor to alter or disrupt system logging activities. This can aid the malicious actor in avoiding detection and further their ability to conduct malicious activities on the system.

Check Content

Check the mode of /etc/syslog.conf using command:
# ls -al /etc/syslog.conf

The above command should yield the following output:
-rw-r----- 1 root system 993 Mar 11 07:04 /etc/syslog.conf

If the file has a mode more permissive than "0640", this is a finding.

Fix Text

Change the mode of the file to 0640 using command: 
# chmod 0640 /etc/syslog.conf