System log files must have mode 0640 or less permissive.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-787	GEN001260	SV-64487r3_rule		Medium

Description
If the system log files are not protected, unauthorized users could change the logged data, eliminating its forensic value.

STIG	Date
Oracle Linux 5 Security Technical Implementation Guide	2020-02-25

Details

Check Text ( C-52909r3_chk )
Check the mode of log files. Procedure: # find /var/log /var/log/syslog /var/adm -type f -perm -640 \! -perm 640 With the exception of /var/log/wtmp, /var/log/Xorg.0.log, and /var/log/gdm/:0.log, if any of the log files have modes more permissive than 0640, this is a finding.

Fix Text (F-55087r1_fix)
Change the mode of the system log file(s) to 0640 or less permissive. Procedure: # chmod 0640 /path/to/system-log-file Note: Do not confuse system log files with audit logs.