The AIX /etc/syslog.conf file must be group-owned by root.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-245562	AIX7-00-002145	SV-245562r755127_rule		Medium

Description
Unauthorized group ownership of the /etc/syslog.conf file can lead to the ability for a malicious actor to alter or disrupt system logging activities. This can aid the malicious actor in avoiding detection and further their ability to conduct malicious activities on the system.

STIG	Date
IBM AIX 7.x Security Technical Implementation Guide	2021-06-16

Details

Check Text ( C-48841r755125_chk )
Check the group ownership of /etc/syslog.conf using command: # ls -al /etc/syslog.conf The above command should yield the following output: -rw-r----- 1 root root 993 Mar 11 07:04 /etc/syslog.conf If the file is not group-owned by root, this is a finding.

Fix Text (F-48796r755126_fix)
Change the ownership of the file to root using command: # chgrp root /etc/syslog.conf