Run rsyslog and create its log files with restricted permissions

Description

When rsyslog is the chosen logging system, its service must be enabled and running, and the files it creates must not be readable by other users: the last $FileCreateMode in /etc/rsyslog.conf and /etc/rsyslog.d/*.conf must be 0640 or stricter.

The choice between the journal alone and rsyslog is left to the administrator: this control does not install rsyslog. CB-DEB-AUDIT-002 aligns the journal forwarding with that choice.

Rationale

rsyslog is what writes /var/log/syslog, /var/log/auth.log and forwards messages to a log server. When it is stopped, those files and the remote copy stop without any error. A restrictive creation mode keeps new and rotated log files private to root and the adm group.

Impact

None known. Debian already ships $FileCreateMode 0640.

Applies when

Detected: when: rsyslog is installed A scanner reports the control not applicable when one is false.

Only when rsyslog is installed. Debian 12 and 13 log to the systemd journal by default and do not install rsyslog; installing it is the choice of rsyslog as the logging system.

Setting

Audit

1. Run systemctl is-enabled rsyslog and systemctl is-active rsyslog. They must print enabled and active.
2. Run grep -h '^\s*\$FileCreateMode' /etc/rsyslog.conf /etc/rsyslog.d/*.conf | tail -n 1. The mode must be 0640 or stricter.

Automated: every check must pass. Scanners report each check by its id.

service

rsyslog.service is enabled.

unit: rsyslog.service
state: enabled

active

rsyslog.service is running.

script: |
  o=$(systemctl is-active rsyslog 2>/dev/null)
  echo "rsyslog: ${o:-unknown}"
  [ "$o" = active ]

file-mode

Last $FileCreateMode of the rsyslog configuration.

script: |
  m=$(cat /etc/rsyslog.conf /etc/rsyslog.d/*.conf 2>/dev/null | sed -n 's/^[[:space:]]*\$FileCreateMode[[:space:]]\{1,\}\([0-7]\{3,4\}\).*/\1/p' | tail -n 1)
  echo "\$FileCreateMode ${m:-unset (rsyslog default 0644)}"
  [ -n "$m" ] && [ $((0$m & 0137)) -eq 0 ]

Remediation

1. Run systemctl enable --now rsyslog.
2. Create /etc/rsyslog.d/60-cirsec.conf with $FileCreateMode 0640 and run systemctl restart rsyslog.

Rollback

Delete /etc/rsyslog.d/60-cirsec.conf and run systemctl restart rsyslog.

service

Generated from check service: the engine writes the fix for every output, it sets the expected value and the check runs again after.

file-mode

f=/etc/rsyslog.d/60-cirsec.conf
cb_backup "$f"
printf '%s\n' '# Written by CIRSEC Baselines CB-DEB-AUDIT-005' '$FileCreateMode 0640' >"$f"
chmod 644 "$f"

Handwritten code reads parameters from CB_<NAME> environment variables. Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• rsyslog.conf(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R71) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-AUDIT-002 Forward the journal to rsyslog only when rsyslog is the chosen logger

People and lifecycle