The first issue:
According to /etc/defaults/rc.donf, accounting service is disabled by default.
While in /etc/defaults/periodic.conf, 310.accounting is enabled and will be executed everyday.
Therefore the following error message shows up in periodic's daily log(which is /var/log/daily.log by default):
Rotating accounting logs and gathering statistics:
Cannot 'rotate_log' accounting. Set accounting_enable to YES in /etc/rc.conf or use 'onerotate_log' instead of 'rotate_log'.
cp: acct.0: No such file or directory
sa: open /var/account/acct.merge for read/write: No such file or directory
rm: acct.merge: No such file or directory
The second issue:
According to FreeBSD Handbook(https://www.freebsd.org/doc/handbook/security-accounting.html) the file permission of /var/account/acct should be 600, while in script /etc/rc.d/accounting, the permission of that file will be always changed to 644. I think either Handbook or rc script must be wrong.
A commit references this bug:
Date: Sun Jul 7 17:15:45 UTC 2019
New revision: 349807
Eliminate spurious periodic.daily error message for rotating accounting log.
In 2011, r218961 removed local code for rotating logs in favor of using the
rotate_log command in etc/rc.d/accounting. If the accounting service is
activated then subsequently de-activated in rc.conf but still remains active
in periodic.conf, then you get an error message every day in the periodic
jobs about being unable to rotate the logs.
With this change to use "onerotate_log", the log rotation will happen the
first time periodic daily runs after accounting was disabled but periodic
accounting was left enabled. After that happens once, the /var/account/acct
will no longer exist, which results in a different path through the periodic
code and no more error messages will appear (unless daily_show_badconfig is
set, in which case the admin will be told that periodic security processing
is enabled but the accounting file is not present).
This is only a partial fix for the problems reported in PR 202203.
r349807 should eliminate the spurious daily error messages. I believe that leaves two things to fix:
1. the rc.d/accounting script recreates the acct file every day with insecure file mode bits (likewise when it creates the /var/account dir).
2. The advice in the handbook has become outdated.
For #1, I've posted a phab review, https://reviews.freebsd.org/D20876
For #2, I propose updating the handbook. I'm not a docs person, so I don't have a diff for that, but I propose that the new sequence for enabling it be changed from touch/chmod/accton/sysrc to:
service accounting enable
service accounting start
Then a paragraph should be added about file security, something like:
The accounting information is stored in files located in /var/account, which is automatically created, if necessary, the first time the accounting service starts. These files contain sensitive information, including all the commands issued by all users. Write access to the files is limited to root, and read access is limited to root and members of the wheel group. To also prevent members of wheel from reading the files, change the mode of the /var/account directory to allow access only by root.
A commit references this bug:
Date: Sat Jul 13 16:07:38 UTC 2019
New revision: 349974
Limit access to system accounting files.
In 2013 the security chapter of the Handbook was updated in r42501 to
suggest limiting access to the system accounting file [*1] by creating the
initial file with a mode of 0600. This was in part based on a discussion in
the forums [*2]. Unfortunately, this advice is overridden by the fact that a
new file is created as part of periodic daily processing, and the file mode
is set by the rc.d/accounting script.
These changes update the accounting script to create the directory with mode
0750 if it doesn't already exist, and to create the daily file with mode
0640. This limits write access to root only, read access to root and members
of wheel, and eliminates world access completely. For admins who want to
prevent even members of wheel from accessing the files, the mode of the
/var/account directory can be manually changed to 0700, because the script
never creates or changes that directory if it already exists.
The accounting_rotate_log() function now also handles the error cases of no
existing log file to rotate, and attempting to rotate the file multiple
times (.0 file already exists).
Another small change here eliminates the complexity of the mktemp/chmod/mv
sequence for creating a new acct file by using install(1) with the flags
needed to directly create the file with the desired ownership and
modes. That allows coalescing two separate if checkyesno accounting_enable
blocks into one.
These changes were inspired by my investigation of PR 202203.
Differential Revision: https://reviews.freebsd.org/D20876