Wouldn't it be possible to walk the /var/log/directory and for each file perform a look up in the rsyslog configuration file. If it exists then it is managed by rsyslog and therefore must have specific ownership. If the grep fails to return a record from either /etc/rsyslog.conf or a file within /etc/rsyslog.d/ then it would be safe to ignore.
Your thoughts?
On Sat, 2013-08-17 at 13:54 -0400, Trevor Vaughan wrote:
This would definitely be a case where I'd use an external helper script.
From the configs that I have, you only seem to care about:
$IncludeConfig .* <= Parse whatever this glob results in.
Anything that does not start with $[A-Z], ends a line, has spaces before it, and has a slash in it.
IF the file referenced exists, then check the file for permissions.
That should at least get you to the 80% mark.
If you want to get fancy, you could point out things in /var/log (or all base directories that you discover) that aren't referenced and have them be automatically checked.
Trevor
On Tue, Aug 13, 2013 at 4:38 PM, Kayse, Josh Joshua.Kayse@gtri.gatech.eduwrote:
On Aug 13, 2013, at 4:16 PM, "Truhn, Chad M CTR NSWCDD, CXA30" < chad.m.truhn.ctr@navy.mil> wrote:
How do you think we should handle file owner and group permission checks on rsyslog files? Should we look for a predetermined list of files (trying to search for *.log is insufficient, since at the very least, /var/log/messages, /var/log/secure, and /var/log/maillog would get passed over)? Or should we try ninja regex to parse rsyslog.conf?
I'm torn. The 'right way' would be regex ninja. However that's hard, and has resulted in nothing getting done. Personally I'd rather have *something* hard coded, then evolve into ninja regex.
I don't know if it is even really an option, but I would personally like
to see it always fail with something like a manual check rather than hard coding some things that will not necessarily reflect the real state of the system. If you hard code fileA, fileB, and fileC and I also have fileD, you could potentially give a false Pass if fileD was 777.
I think a regex is the only way that you could ever pass with some
degree of confidence, but the rsyslog config file is SUPER hard. I don't want to downplay anyone's regex skills, but rsyslog deals with some variables (like %HOSTNAME%, %syslogfacility%, etc) that can be used in the file path/name. How could you ever be able to derive that? I think any normal person would have a system where syslog sends things to a directory where other files should not be, but is it safe to assume?
I could be negatively skewed here, but I personally would prefer to have
a false failure or a manual check than a false pass. The CISSP stuff beat that into my head with a rather large bat. But I'm not the one doing the hard work here, you guys are. Just my $0.02.
I would add my concurrence to this suggestion. You can use an include dir in rsyslog such that the configuration is built up amongst multiple files; how would that be handled?
-josh _______________________________________________ scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide
scap-security-guide mailing list scap-security-guide@lists.fedorahosted.org https://lists.fedorahosted.org/mailman/listinfo/scap-security-guide