#NEWLINE# def testLogFilesCheck( self ) : #NEWLINE# #INDENT# 'Ensure log files check detects files modifiable by non-root.' #NEWLINE# data = [ self . CreateStat ( '/var/log/syslog' , 0 , 0 , 33206 ) , self . CreateStat ( '/var/log/auth.log.1' , 0 , 4 , 33276 ) , self . CreateStat ( '/var/log/debug.1.gz' , 10 , 0 , 33276 ) , self . CreateStat ( '/var/log/mail.log' , 0 , 2 , 33272 ) , self . CreateStat ( '/var/log/user.log.1.gz' , 0 , 4 , 33186 ) , self . CreateStat ( '/var/log/puppet/mail.log' , 30 , 70 , 33279 ) , self . CreateStat ( '/var/log/dpkg.log' , 200 , 70 , 33204 ) ] #NEWLINE# results = self . GenResults ( [ 'LinuxLogFiles' ] , [ data ] ) #NEWLINE# check_id = 'CIS-LOG-FILES-PERMISSIONS-WRONG-OWNER' #NEWLINE# sym = 'Found: Vital system log files have wrong owner.' #NEWLINE# found = [ '/var/log/debug.1.gz user: 10, group: 0, mode: -rwxrwxr--' , '/var/log/dpkg.log user: 200, group: 70, mode: -rw-rw-r--' ] #NEWLINE# self . assertCheckDetectedAnom ( check_id , results , sym , found ) #NEWLINE# check_id = 'CIS-LOG-FILES-PERMISSIONS-WRONG-GROUP' #NEWLINE# sym = 'Found: Vital system log files have wrong group.' #NEWLINE# found = [ '/var/log/mail.log user: 0, group: 2, mode: -rwxrwx---' , '/var/log/dpkg.log user: 200, group: 70, mode: -rw-rw-r--' ] #NEWLINE# self . assertCheckDetectedAnom ( check_id , results , sym , found ) #NEWLINE# check_id = 'CIS-LOG-FILES-PERMISSIONS-WORLD-WRITABLE' #NEWLINE# sym = 'Found: Log files are world writable.' #NEWLINE# found = [ '/var/log/syslog user: 0, group: 0, mode: -rw-rw-rw-' , '/var/log/puppet/mail.log user: 30, group: 70, mode: -rwxrwxrwx' , '/var/log/user.log.1.gz user: 0, group: 4, mode: -rw-r---w-' ] #NEWLINE# self . assertCheckDetectedAnom ( check_id , results , sym , found )