Log file permissions have not been configured to restrict unauthorized users

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-15842	ESX0430	SV-16783r1_rule		Medium

Description
It is critical to protect system log files from being modified or accessed by unauthorized individuals. Some logs may contain sensitive data that should only be available to the virtualization server administrator.

STIG	Date
VMware ESX 3 Server	2016-05-13

Details

Check Text ( C-16188r1_chk )
On the ESX Server service console review the following log file permissions. For each file or folder perform the following: # ls –lL /var/log OR # ls –lL /var/log/(directory) Log Location Permission /var/log/boot.log 600 /var/log/cron 600 /var/log/dmesg 640 /var/log/initrdlogs/ 600 /var/log/ksyms 600 /var/log/maillog 600 /var/log/messages 600 /var/log/oldconf/ 700 /var/log/rpmpkgs 600 /var/log/secure 600 /var/log/spooler 600 /var/log/storageMonitor 600 /var/log/sudolog 600 /var/log/vmkernel 600 /var/log/vmkproxy 600 /var/log/vmksummary 600 /var/log/vmksummary.d/ 600 /var/log/vmkwarning 600 /var/log/vmware/ 700 If any of the directories or files do not match the table above, this is a finding.

Check Text ( C-16188r1_chk )

On the ESX Server service console review the following log file permissions.
For each file or folder perform the following:
# ls –lL /var/log

OR

# ls –lL /var/log/(directory)

Log Location Permission
/var/log/boot.log 600
/var/log/cron 600
/var/log/dmesg 640
/var/log/initrdlogs/ 600
/var/log/ksyms 600
/var/log/maillog 600
/var/log/messages 600
/var/log/oldconf/ 700
/var/log/rpmpkgs 600
/var/log/secure 600
/var/log/spooler 600
/var/log/storageMonitor 600
/var/log/sudolog 600
/var/log/vmkernel 600
/var/log/vmkproxy 600
/var/log/vmksummary 600
/var/log/vmksummary.d/ 600
/var/log/vmkwarning 600
/var/log/vmware/ 700

If any of the directories or files do not match the table above, this is a finding.

Fix Text (F-15796r1_fix)
Restrict unauthorized users from log files.