/var/adm/syslog/syslog.log permissions change after reboot.

[Daniel Simard]

For security purposes, I set the permissions of /var/adm/syslog/syslog.log to 640. Problem is. When I reboot (even as a test), it puts the permissions back to 644!
I think it's because it creates a new syslog and copies the old one to OLDsyslog.log.

Now where does the 644 come from ? Umask 022 in /etc/profile ?? I would like to continue to have umask022 BUT i don't want to have syslog revert to 644 everytime it is rebooted. I have over 40 servers!.

Thanks, Any ideas ?

[John Poff · Accepted solution]

Hi,

It gets created by the /sbin/init.d/syslogd script. That script moves the syslog to OLDsyslog at boot and creates a new syslog file. You could add a line to that script that would change the permissions of syslog back to 640. The only bad part is that your modification could get overwritten by a future patch to that script from HP.

JP

[Pete Randall]

Add another startup script that runs at the end and changes the permissions.

Pete

[Steve Steel]

Hi

Another startup script is the best solution or put it in the roots .profile or /etc/profile


if [ "$LOGNAME" = "root" ]
then
chmod 640 /var/adm/syslog/syslog.log
fi

First login then will fix.


Steve steel

[Martin Johnson]

You should check your applications, especially third party, to verify they don't write to the syslog. Remember, the syslog is a respository on the health of the system and can be used by applications other than OS utilities.

We have webmethods, weblogic, apache and vignette, as well as our own applications, writing messages to syslog that we monitor using ITO.

HTH
Marty

[S.K. Chan]

I take it then you want to tighten the permission of syslog.log file .. audit requirement ? Another way to approach this is you can choose not to log everything to syslog.log by changing /etc/syslog.conf. It can be "re-routed" to another file of your choice that you may have more control of.
just an idea ..