securing oracle linux 9 article 24 managing logfile access logfiles configuration

In the previous part, Configuring Logging was completed.

1. CIS Benchmark Requirements (Section 6.2.4)

The numbering has been reviewed and aligned with the CIS Benchmark standard:

• 6.2.4 Configure Logfiles
• 6.2.4.1 Ensure access to all logfiles has been configured (Automated)

2. Concept and Security Rationale

Log files under /var/log/ contain highly sensitive information, including system errors, security events, authentication details, and sometimes application data. If the permissions of these files are not configured correctly, attackers or unauthorized local users may read them to obtain useful information for further intrusion attempts, resulting in information disclosure. They may also be able to modify log records.

The CIS Benchmark requires log files to be inaccessible for reading or writing by ordinary users. In general, logfile permissions must be no more permissive than 0640. This means that the group and others must not have write or execute permissions, while others must not have read permission.

3. Oracle Database Compatibility Review (RAC and Grid)

Interference status: No interference, provided that path separation is maintained.

Oracle considerations and requirements:

• Path separation: The scripts and commands in this section exclusively target the /var/log/ directory. Oracle logs, including ADR logs, are stored in paths such as $ORACLE_BASE/diag/ and are managed by Oracle-specific utilities.
• No operational impact: Applying these permissions to /var/log/ does not affect Oracle Database or Grid Infrastructure operations. Oracle manages its database logs through its dedicated users and groups, including oracle, grid, oinstall, and dba.
• Auxiliary tools: If Oracle monitoring or support tools, such as TFA or OSWatcher, write logs to or need to read logs from /var/log/, ensure that their log collection processes run as root to prevent Permission Denied errors.

4. Auditing the Current Configuration

This script checks the /var/log path for files or directories with overly permissive access, including group write or execute permissions and other read, write, or execute permissions.

The path of this script in GitHub is: modules/audit_24_Logfiles_Configuration.sh

If you are not familiar with Bash scripting, you may refer to the Bash for Oracle DBAs training published for database administrators.

#!/bin/bash
# Script: audit24.sh
# Purpose: Audit CIS 6.2.4 Logfiles Access Configuration

echo "=========================================================================="
echo " CIS Requirement: Logfiles Access Configuration (CIS 6.2.4)"
echo " - Ensure all general logfiles have permissions of 0640 or more restrictive."
echo " - Ensure /var/log/btmp permissions are 0600 or more restrictive."
echo " - Ensure /var/log/wtmp and lastlog permissions are 0664 or more restrictive."
echo " - Ensure log directories have permissions of 0750 or more restrictive."
echo "--------------------------------------------------------------------------"
echo " Oracle Context & Exceptions:"
echo " - INTERFERENCE: None (Path Isolation)."
echo " - EXPLANATION: Actions target /var/log/. Oracle logs (ADR) reside in"
echo "   \$ORACLE_BASE/diag/ and are managed by Oracle's specific users/groups."
echo " - NOTE: If Oracle auxiliary tools (like TFA or OSWatcher) read /var/log/,"
echo "   they must run as root to avoid 'Permission Denied' errors."
echo "=========================================================================="

AUDIT_STATUS="PASS"

# 1. Check general log files (Expected: max 0640 -> Forbidden bits: 0137)
BAD_FILES=$(find /var/log -type f \( ! -name "wtmp" -a ! -name "lastlog" -a ! -name "btmp" \) -perm /0137 2>/dev/null)
if [ -n "$BAD_FILES" ]; then
    echo "[ FAIL ] General log files with unauthorized permissions (looser than 0640):"
    find /var/log -type f \( ! -name "wtmp" -a ! -name "lastlog" -a ! -name "btmp" \) -perm /0137 -ls 2>/dev/null
    AUDIT_STATUS="FAIL"
else
    echo "[ OK ] General log files permissions are secure."
fi

# 2. Check btmp file (Expected: max 0600 -> Forbidden bits: 0177)
if [ -f /var/log/btmp ]; then
    BAD_BTMP=$(find /var/log/btmp -type f -perm /0177 2>/dev/null)
    if [ -n "$BAD_BTMP" ]; then
        echo "[ FAIL ] /var/log/btmp has unauthorized permissions (looser than 0600):"
        ls -l /var/log/btmp
        AUDIT_STATUS="FAIL"
    else
        echo "[ OK ] /var/log/btmp permission is secure."
    fi
fi

# 3. Check wtmp and lastlog (Expected: max 0664 -> Forbidden bits: 0113)
BAD_WTMP=$(find /var/log -type f \( -name "wtmp" -o -name "lastlog" \) -perm /0113 2>/dev/null)
if [ -n "$BAD_WTMP" ]; then
    echo "[ FAIL ] wtmp/lastlog have unauthorized permissions (looser than 0664):"
    find /var/log -type f \( -name "wtmp" -o -name "lastlog" \) -perm /0113 -ls 2>/dev/null
    AUDIT_STATUS="FAIL"
else
    echo "[ OK ] wtmp/lastlog permissions are secure."
fi

# 4. Check log directories (Expected: max 0750 -> Forbidden bits: 0027)
BAD_DIRS=$(find /var/log -type d -perm /0027 2>/dev/null)
if [ -n "$BAD_DIRS" ]; then
    echo "[ FAIL ] Log directories with unauthorized permissions (looser than 0750):"
    find /var/log -type d -perm /0027 -ls 2>/dev/null
    AUDIT_STATUS="FAIL"
else
    echo "[ OK ] Log directories permissions are secure."
fi

echo "----------------------------------------------------------"
if [ "$AUDIT_STATUS" == "PASS" ]; then
    echo -e "\e[32m[ PASS ] Final Status: Section 24 Auditing Passed Successfully.\e[0m"
else
    echo -e "\e[31m[ FAIL ] Final Status: Section 24 Auditing Failed. Run remediation script.\e[0m"
fi
echo "=========================================================="

5. Applying the Configuration (Remediation Bash Script)

This script automatically corrects the permissions of all files and directories under /var/log and removes unnecessary access privileges.

The path of this script in GitHub is: modules/remediate_24_Logfiles_Configuration.sh

#!/bin/bash
# Script: remediation24.sh
# Purpose: Restrict permissions on logfiles (CIS 6.2.4) with Oracle Exceptions

if [ "$EUID" -ne 0 ]; then echo "Please run as root"; exit 1; fi

echo "=========================================================================="
echo " [ Remediation ] Section 24: Logfiles Access Permissions"
echo " Applying CIS Requirements while maintaining Oracle/System exceptions:"
echo " - Setting general logs to max 0640."
echo " - Setting directories to max 0750."
echo " - Setting btmp to 0600 (root:utmp)."
echo " - Setting wtmp & lastlog to 0664 (root:utmp)."
echo "=========================================================================="

# 1. Restrict general files (excluding exceptions)
find /var/log -type f \( ! -name "wtmp" -a ! -name "lastlog" -a ! -name "btmp" \) -exec chmod g-wx,o-rwx "{}" +

# 2. Restrict directories
find /var/log -type d -exec chmod g-w,o-rwx "{}" +

# 3. Apply exceptions for btmp
if [ -f /var/log/btmp ]; then
    chmod 0600 /var/log/btmp
    chown root:utmp /var/log/btmp
fi

# 4. Apply exceptions for wtmp and lastlog
for file in /var/log/wtmp /var/log/lastlog; do
    if [ -f "$file" ]; then
        chmod 0664 "$file"
        chown root:utmp "$file"
    fi
done

echo "[+] Logfiles permissions successfully restricted and exceptions applied."

In the next part, we will cover Auditd Service and Log Retention .