# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-DEB-AUDIT-004
title: Restrict access to log files
finding:
  title: Log files are readable or writable by too many users
  description: Logs hold user names, addresses, commands and sometimes secrets; files readable by everyone leak them, and writable files can be falsified.
status: active
profiles: [core]
risk:
  severity: medium
assessment: automated
tags: [logging, permissions, journald]

description: |
  Every regular file under `/var/log/`, including the journal files in `/var/log/journal/`, must
  have no permission for other users, no write permission for its group and no execute bit
  (mode `0640` or stricter).

  Two exceptions:

  - the session records `wtmp`, `btmp` and `lastlog` (and their rotated copies) must stay writable
    by the `utmp` group, and `wtmp` and `lastlog` readable by everyone for `last` and `lastlog` to
    work: for them only execute bits and writes by other users are forbidden (mode `0664` or
    stricter);
  - the package manager logs in `/var/log/apt/`, which apt recreates readable by everyone at each
    run, may be `0644`;
  - the files matching `tolerated_0644` (by default `dpkg.log*` and `alternatives.log*`, which
    logrotate recreates with `create 0644`) may be `0644` too. They must never be writable by
    group or others.

  journald creates its files with mode `0640` (set in `/usr/lib/tmpfiles.d/systemd.conf`), and
  rsyslog with `$FileCreateMode` (CB-DEB-AUDIT-005).
rationale: |
  Logs record failed logins (sometimes with a password typed in the user name field), source
  addresses, commands and application data. Readable logs help an attacker map the system;
  writable logs let them erase or forge their traces.
impact: |
  Users who are not in the `adm` group can no longer read files such as `/var/log/cloud-init.log`.
  Grant access with group membership (`adm`) instead of wider modes.
notes: |
  On a fresh Debian 12 or 13 cloud image, `dpkg.log`, `faillog` and, on Debian 12,
  `cloud-init.log` are `0644`. A file recreated by its program or by logrotate with a
  `create 0644` directive goes back to the wider mode until the fix runs again: list such files
  in `tolerated_0644`, or change the `create` mode in `/etc/logrotate.d/`.

setting:
  location: /var/log/
  default_value: Several files 0644
  recommended_value: "0640 or stricter; 0664 for wtmp, btmp and lastlog; 0644 in /var/log/apt and for {{ tolerated_0644 }}"

parameters:
  - name: tolerated_0644
    type: list
    description: File name patterns under /var/log allowed to be 0644 (never group or world writable).
    default: ["dpkg.log*", "alternatives.log*"]

audit:
  manual: |
    Run, as root:
    ```
    find /var/log -type f ! -path '/var/log/apt/*' ! -name 'wtmp*' ! -name 'btmp*' ! -name 'lastlog*' -perm /0137 -ls
    find /var/log -type f \( -name 'wtmp*' -o -name 'btmp*' -o -name 'lastlog*' \) -perm /0113 -ls
    find /var/log/apt -type f -perm /0133 -ls
    ```
    The commands must print nothing, except files matching {{ tolerated_0644 }} reported by the
    first command with mode `0644` (they must not be writable by group or others).
  checks:
    - id: var-log
      engine: shell
      description: Files under /var/log with more access than allowed.
      spec:
        script: |
          [ -d /var/log ] || exit 2
          set -f
          ex= tol=
          for p in $CB_TOLERATED_0644; do ex="$ex ! -name $p"; tol="$tol -o -name $p"; done
          bad=$( { find /var/log -type f ! -path '/var/log/apt/*' ! -name 'wtmp*' ! -name 'btmp*' ! -name 'lastlog*' $ex -perm /0137
            find /var/log -type f \( -name 'wtmp*' -o -name 'btmp*' -o -name 'lastlog*' \) -perm /0113
            find /var/log/apt -type f -perm /0133
            [ -z "$tol" ] || find /var/log -type f \( ${tol# -o } \) -perm /0133; } 2>/dev/null)
          set +f
          if [ -n "$bad" ]; then
            printf '%s\n' "$bad" | while IFS= read -r f; do stat -c '%n %a' "$f"; done
            exit 1
          fi
          echo "no log file under /var/log is more permissive than allowed"

remediation:
  manual: |
    Run, as root:
    ```
    find /var/log -type f ! -path '/var/log/apt/*' ! -name 'wtmp*' ! -name 'btmp*' ! -name 'lastlog*' -perm /0137 -exec chmod u-x,g-wx,o-rwx {} +
    find /var/log -type f \( -name 'wtmp*' -o -name 'btmp*' -o -name 'lastlog*' \) -perm /0113 -exec chmod u-x,g-x,o-wx {} +
    find /var/log/apt -type f -perm /0133 -exec chmod u-x,g-wx,o-wx {} +
    ```
    For files rotated by logrotate, also change the `create` mode in the matching
    `/etc/logrotate.d/` file.
  effects:
    restart: none
    disruption: low
    lockout_risk: false
  rollback: |
    Run `chmod 644` on the files that need to be readable by everyone again.
  scripts:
    - id: chmod
      engine: shell
      content: |
        set -f
        ex= tol=
        for p in $CB_TOLERATED_0644; do ex="$ex ! -name $p"; tol="$tol -o -name $p"; done
        find /var/log -type f ! -path '/var/log/apt/*' ! -name 'wtmp*' ! -name 'btmp*' ! -name 'lastlog*' $ex -perm /0137 -exec chmod u-x,g-wx,o-rwx {} +
        find /var/log -type f \( -name 'wtmp*' -o -name 'btmp*' -o -name 'lastlog*' \) -perm /0113 -exec chmod u-x,g-x,o-wx {} +
        find /var/log/apt -type f -perm /0133 -exec chmod u-x,g-wx,o-wx {} +
        [ -z "$tol" ] || find /var/log -type f \( ${tol# -o } \) -perm /0133 -exec chmod u-x,g-wx,o-wx {} +
        set +f

references:
  - title: tmpfiles.d(5), Debian manual pages
    url: https://manpages.debian.org/trixie/systemd/tmpfiles.d.5.en.html
    publisher: Debian
    kind: vendor-doc
    accessed: 2026-10-18
  - title: logrotate(8), Debian manual pages
    url: https://manpages.debian.org/trixie/logrotate/logrotate.8.en.html
    publisher: Debian
    kind: vendor-doc
    accessed: 2026-10-18
  - title: ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R71)
    url: https://messervices.cyber.gouv.fr/documents-guides/fr_np_linux_configuration-v2.0.pdf
    publisher: ANSSI
    kind: guide
    accessed: 2026-10-18
mappings:
  - framework: anssi-linux
    framework_version: "2.0"
    id: R71
    relation: partial
    note: R71 asks for protected logs; this control covers local file permissions.
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AU-9
    relation: related
  - framework: cis-debian-12
    framework_version: "2.0.0"
    id: "6.1.1.1.4"
    relation: equivalent
  - framework: cis-debian-12
    framework_version: "2.0.0"
    id: "6.1.3.1"
    relation: partial
    note: Ours checks modes only, not owners; it does not allow 0644 for cloud-init logs.
  - framework: cis-debian-13
    framework_version: "1.1.0"
    id: "6.1.1.1.4"
    relation: equivalent
  - framework: cis-debian-13
    framework_version: "1.1.0"
    id: "6.1.3.1"
    relation: partial
    note: Ours checks modes only, not owners; it does not allow 0644 for cloud-init logs.
threats:
  - framework: mitre-attack
    id: T1070.002
  - framework: cwe
    id: CWE-532
  - framework: cwe
    id: CWE-732

authors:
  - name: Alice
    github: Sn0wAlice
verified:
  - date: 2026-10-18
    by: Sn0wAlice
    versions: ["12"]
    environment: Proxmox VM, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64, BIOS boot
    notes: "Fails on fresh install (dpkg.log, faillog, cloud-init.log 0644); fix restricts them; passes after AIDE install and reboot."
  - date: 2026-10-18
    by: Sn0wAlice
    versions: ["13"]
    environment: Proxmox VM, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64, BIOS boot
    notes: "Fails on fresh install (dpkg.log 0644); fix restricts it; passes after AIDE install and reboot."
introduced_in: 0.1.0
created: 2026-10-18
updated: 2026-10-18