Detections
Analytics

6.1.2.11 Ensure rsyslog network forwarding uses TLS

Information

When rsyslog forwards logs to a remote host, the omfwd output action can wrap the connection in TLS by selecting a TLS network stream driver (gtls or ossl), running that driver in TLS-only mode, and setting a peer authentication mode. The driver may be selected globally (DefaultNetstreamDriver) or per action (StreamDriver), using either the modern advanced (global(...) / action(...)) syntax or the legacy $-directive syntax. This recommendation applies only where rsyslog forwards to a remote host; hosts that do not forward syslog over the network may document it as Not Applicable.

If forwarding is not wrapped in TLS, syslog traffic crosses the network in clear text and is subject to interception, modification, or silent loss. Selecting a TLS stream driver and forcing TLS-only mode ensures the connection is encrypted, and setting an authentication mode ensures rsyslog will only deliver logs to a verified remote peer, defeating passive sniffing and man-in-the-middle attacks against the log stream.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure rsyslog to forward over TLS using a drop-in file, the recommended method for local rsyslog configuration, and ensure no plaintext forwarding action remains.

 - Run the following command to locate any existing forwarding actions for review:

# grep -PHns -- 'type="omfwd"|^\h*[^#]*@' /etc/rsyslog.conf /etc/rsyslog.d/*.conf

 -

In each file returned, remove or convert to TLS any forwarding action that is not already TLS-secured, so the only remaining forwarding path uses TLS.

 -

Create a drop-in file such as /etc/rsyslog.d/60-forward-tls.conf with the TLS forwarding configuration. The example below uses the GnuTLS driver:

# Select the TLS driver and trust material globally
global(
 DefaultNetstreamDriver="gtls"
 DefaultNetstreamDriverCAFile="/etc/pki/tls/certs/ca-bundle.crt"
)

# Forward all messages to the remote collector over TLS only
*.* action(type="omfwd"
 target="loghost.example.com" port="6514" protocol="tcp"
 StreamDriver="gtls"
 StreamDriverMode="1"
 StreamDriverAuthMode="x509/name"
 StreamDriverPermittedPeers="loghost.example.com"
 action.resumeRetryCount="100"
 queue.type="LinkedList" queue.size="1000")

 - Run the following command to restart rsyslog :

# systemctl restart rsyslog

If the OpenSSL driver is preferred, substitute ossl for gtls in the DefaultNetstreamDriver and StreamDriver settings above.

Impact:

Enabling TLS forwarding requires that the remote collector also accept TLS on the encrypted port and that the necessary CA (and, for mutual authentication, client certificate and key) material be present and current. Using TLS-only mode means forwarding will not silently fall back to clear text: if the TLS handshake fails, messages queue or drop rather than being sent unencrypted, so certificate or connectivity problems become forwarding outages until corrected.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|14.4

Plugin: Unix

Control ID: ce817db82153b8ade1fe93854345273d34eddc1a40458835ea7de9787c8e3a5b