Detections
Analytics

Revision 1.19

Nov 6, 2023
Functional Update
  • 4.2.1.1 Ensure rsyslog is installed
  • 4.2.1.2 Ensure rsyslog service is enabled
  • 4.2.1.3 Ensure journald is configured to send logs to rsyslog
  • 4.2.1.4 Ensure rsyslog default file permissions are configured
  • 4.2.1.5 Ensure logging is configured
  • 4.2.1.6 Ensure rsyslog is configured to send logs to a remote log host
  • 4.2.1.7 Ensure rsyslog is not configured to receive logs from a remote client
  • 4.2.2.1.1 Ensure systemd-journal-remote is installed
  • 4.2.2.1.2 Ensure systemd-journal-remote is configured
  • 4.2.2.1.3 Ensure systemd-journal-remote is enabled
  • 4.2.2.2 Ensure journald service is enabled
  • 4.2.2.3 Ensure journald is configured to compress large log files
  • 4.2.2.4 Ensure journald is configured to write logfiles to persistent disk
  • 4.2.2.5 Ensure journald is not configured to send logs to rsyslog
  • 4.2.2.6 Ensure journald log rotation is configured per site policy
  • 4.2.2.7 Ensure journald default file permissions configured
  • 5.4.1 Ensure custom authselect profile is used
Informational Update
  • 4.2.1.1 Ensure rsyslog is installed
  • 4.2.1.2 Ensure rsyslog service is enabled
  • 4.2.1.3 Ensure journald is configured to send logs to rsyslog
  • 4.2.1.4 Ensure rsyslog default file permissions are configured
  • 4.2.1.5 Ensure logging is configured
  • 4.2.1.6 Ensure rsyslog is configured to send logs to a remote log host
  • 4.2.1.7 Ensure rsyslog is not configured to receive logs from a remote client
  • 4.2.2.1.1 Ensure systemd-journal-remote is installed
  • 4.2.2.1.2 Ensure systemd-journal-remote is configured
  • 4.2.2.1.3 Ensure systemd-journal-remote is enabled
  • 4.2.2.2 Ensure journald service is enabled
  • 4.2.2.3 Ensure journald is configured to compress large log files
  • 4.2.2.4 Ensure journald is configured to write logfiles to persistent disk
  • 4.2.2.5 Ensure journald is not configured to send logs to rsyslog
  • 4.2.2.6 Ensure journald log rotation is configured per site policy
  • 4.2.2.7 Ensure journald default file permissions configured
Miscellaneous
  • References updated.
Added
  • 4.2.2.1.4 Ensure journald is not configured to receive logs from a remote client
  • 4.2.3 Ensure all logfiles have appropriate access configured
Removed
  • 4.2.2.1.2 Ensure systemd-journal-remote is configured - URL
  • 4.2.2.1.4 Ensure journald is not configured to recieve logs from a remote client
  • 4.2.3 Ensure all logfiles have appropriate permissions and ownership