# Ensure access to all logfiles has been configured

The security and integrity of system log files are critical for monitoring, troubleshooting, and forensic analysis. Misconfigured permissions can expose sensitive system and user information or allow an attacker to tamper with logs to hide their activities.

**Necessity:** Log files often contain sensitive data, including user activity, IP addresses, service errors, and application behavior. If world-readable, any user on the system can access this information for reconnaissance. If they are writable by unauthorized users, an attacker could alter or delete log entries to cover their tracks, severely hindering incident response.

**Auditing and Remediation:** The audit script systematically checks the permission mode of every file in '/var/log', identifying those that do not conform to the secure baseline. The remediation script enforces the desired security policy by using 'chmod' to set the correct permissions and 'chown' to set the appropriate ownership ('root:adm') across all log files, ensuring a consistent and secure state.

**Recommended State Rationale:**
- **Basic/Moderate ('640'):** This state sets permissions to read/write for the owner ('root') and read-only for the group ('adm'). This is a widely accepted best practice (e.g., CIS Benchmark recommendation) that balances security with operational requirements. It allows legitimate administrative users in the 'adm' group to read logs for diagnostic purposes while preventing all other non-privileged users from accessing them.
- **Strict ('600'):** This state provides the highest level of security by restricting all access to the owner ('root') only. This adheres strictly to the principle of least privilege. It is recommended for high-security environments where any potential for unauthorized information disclosure, even to other administrative groups, must be eliminated. In this configuration, log access for troubleshooting would require elevated privileges (e.g., using 'sudo').

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['640']` |
| **Moderate** | `['640']` |
| **Strict** | `['600']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that searches for all files within the '/var/log/' directory and its subdirectories. The script must identify any file with permissions more permissive than '640' (i.e., group writable or world-readable/writable/executable). The script must output a single, space-separated string containing the full paths of all non-compliant files. If all files are compliant, it must return an empty string.

## Remediation Script Working

Bash script that accepts one positional command-line argument: a three-digit octal permission mode (e.g., '640'). The script must find all files within '/var/log/' and apply the specified permission mode. It must also ensure the user ownership is 'root' and group ownership is 'adm' for all files and directories within '/var/log/'. The script must return 'true' on successful completion or 'false' if any errors occur.

