The AIX /etc/syslog.conf file must have a mode of 0640 or less permissive.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-245563	AIX7-00-002146	SV-245563r818809_rule		Medium

Description
Unauthorized permissions of the /etc/syslog.conf file can lead to the ability for a malicious actor to alter or disrupt system logging activities. This can aid the malicious actor in avoiding detection and further their ability to conduct malicious activities on the system.

STIG	Date
IBM AIX 7.x Security Technical Implementation Guide	2022-06-06

Details

Check Text ( C-48842r818807_chk )
Check the mode of /etc/syslog.conf using command: # ls -al /etc/syslog.conf The above command should yield the following output: -rw-r----- 1 root system 993 Mar 11 07:04 /etc/syslog.conf If the file has a mode more permissive than "0640", this is a finding.

Fix Text (F-48797r818808_fix)
Change the mode of the file to 0640 using command: # chmod 0640 /etc/syslog.conf