Rule ID
SV-45976r1_rule
Version
V1R12
CCIs
If the /etc/syslog.conf file is not owned by root, unauthorized users could be allowed to view, edit, or delete important system messages handled by the syslog facility.
Check /etc/rsyslog.conf ownership: # ls –lL /etc/rsyslog* If any rsyslog configuration file is not owned by root, this is a finding.
Use the chown command to set the owner to root. # chown root <rsyslog configuration file>