# Ensure rsyslog log file creation mode is configured

The '$FileCreateMode' directive in rsyslog's configuration controls the file system permissions for all newly created log files. Properly restricting these permissions is critical for protecting the confidentiality and integrity of log data. Unrestricted access could allow unauthorized users to read sensitive operational data, system configurations, or user activity. It could also allow an attacker to modify or delete logs to conceal malicious activity, thereby undermining forensic investigations and system audits. The audit script verifies the current permission setting by parsing the rsyslog configuration files. The remediation script directly modifies the configuration to enforce the desired permission mode and restarts the service to ensure the change takes effect. A 'Basic' state of '0640' is recommended as it allows the owner (root) to read/write and a designated group (e.g., adm) to read, which is common for monitoring tools, while denying access to other users. The 'Moderate' and 'Strict' states recommend '0600', which provides a higher level of security by ensuring only the root user can read or write to the log files, strictly adhering to the principle of least privilege.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['0640']` |
| **Moderate** | `['0600']` |
| **Strict** | `['0600']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the '/etc/rsyslog.conf' file and any files within '/etc/rsyslog.d/' for the '$FileCreateMode' directive. The script must parse the configuration to find the assigned octal value and print only the value (e.g., '0640') to standard output, with no additional text or formatting.

## Remediation Script Working

Bash script that accepts a single positional command-line argument representing the desired file creation mode (e.g., '0640'). The script must find the '$FileCreateMode' directive in '/etc/rsyslog.conf'. If the directive exists, it should be updated with the provided value; if it does not exist, it should be added. The script must restart the rsyslog service to apply the changes and output 'true' on successful configuration and service restart, or 'false' if any step fails.

