# Ensure access to all logfiles has been configured

The necessity of this control is to protect sensitive system and application data contained within log files. Log files often record user activities, IP addresses, system errors, and application behavior, which could be exploited by unauthorized users for reconnaissance or privilege escalation. If log files are world-readable, any user on the system can access this potentially sensitive information. If they are world-writable, a malicious actor could alter or delete logs to cover their tracks, thereby subverting forensic investigations and security audits. The audit script checks for this vulnerability by scanning all log files in /var/log and reporting 'Non-Compliant' if any file allows access to 'others'. The remediation script corrects this by systematically removing these permissions, ensuring that only privileged accounts (root and members of the root group) can access them. All recommended states are set to 'Compliant' because this is a foundational security principle; there is no acceptable level of insecure log file permissions. Proper configuration is a binary state—it is either correct or it is not.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Compliant']` |
| **Moderate** | `['Compliant']` |
| **Strict** | `['Compliant']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that recursively scans all files within the /var/log directory. For each file, the script must check if it grants any permissions (read, write, or execute) to 'others'. If one or more files are found with permissions for 'others', the script must output the single word 'Non-Compliant'. If all files are correctly configured with no permissions for 'others', it must output the single word 'Compliant'.

## Remediation Script Working

Bash script that accepts one argument: 'Compliant'. When the script is executed with this argument, it must recursively find all files in the /var/log directory and remove all read, write, and execute permissions for the 'others' category (e.g., using 'chmod o-rwx'). It should also ensure the owner and group for all log files is 'root'. The script must return 'true' on successful completion and 'false' if an error occurs.

