# Ensure rsyslog log file creation mode is configured

Necessity: Setting a secure file creation mode for rsyslog is critical for protecting the confidentiality and integrity of log data. System logs can contain sensitive information, including user activity, IP addresses, system errors, and application behavior. If log files have insecure permissions, unauthorized users or processes could read this sensitive data, potentially leading to information disclosure, privilege escalation, or an attacker's ability to cover their tracks by modifying or deleting log entries.

Auditing and Remediation: The audit script inspects the active rsyslog configuration files ('/etc/rsyslog.conf' and '/etc/rsyslog.d/*') to determine the currently set value for the '$FileCreateMode' directive, which dictates the permissions for newly created log files. The remediation script modifies the configuration to enforce a specific, secure file mode and then restarts the rsyslog service to apply the change immediately.

Recommended State Rationale:
- Basic/Moderate: ['0640'] - This state is the widely accepted best practice (e.g., recommended by CIS Benchmarks). It configures permissions so that only the owner (root) has read/write access, and a specific group (typically 'adm' or 'syslog') has read-only access. This allows legitimate administrative tools and users to monitor logs without granting excessive permissions to other accounts on the system.
- Strict: ['0600'] - This state provides maximum confidentiality by restricting all access (read and write) exclusively to the root user. This is suitable for high-security environments where the principle of least privilege is paramount, ensuring that no other user or group can access log file contents, thereby minimizing the risk of sensitive information exposure.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0640']` |
| **Moderate** | `['0640']` |
| **Strict** | `['0600']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that queries the rsyslog configuration to find the value of the '$FileCreateMode' directive. The script should search '/etc/rsyslog.conf' and all files within '/etc/rsyslog.d/'. The script must output only the numerical mode value (e.g., '0640') with no additional text or formatting. If the value is not set, the script should return nothing.

## Remediation Script Working

Bash script that accepts a single positional argument representing the desired file creation mode (e.g., '0640'). The script must update the rsyslog configuration by setting the '$FileCreateMode' directive to the provided value. If the directive already exists in '/etc/rsyslog.conf' or '/etc/rsyslog.d/*.conf', it should be updated; otherwise, it should be added to a new configuration file in '/etc/rsyslog.d/'. After updating the configuration, the script must restart the 'rsyslog' service. The script must return 'true' upon successful application of the setting and service restart, and 'false' otherwise.

