Detections
Analytics

6.1.2.10 Ensure a rsyslog TLS network stream driver is installed

Information

rsyslog encrypts forwarded syslog traffic using a TLS network stream driver, a layer between rsyslog and the transport that provides confidentiality, integrity, and peer authentication for messages sent over the network using the syslog-transport-tls standard. Two interchangeable drivers are available and packaged separately: the GnuTLS driver gtls (package rsyslog-gnutls) and the OpenSSL driver ossl (package rsyslog-openssl). Either driver satisfies this recommendation; only the selected driver's package needs to be installed.

Installing a TLS network stream driver ensures the capability to forward logs over an encrypted, authenticated channel is available whenever remote forwarding is used.

Traditional syslog forwarding is a clear-text protocol, so anyone able to observe the network can read forwarded log data. A TLS network stream driver implements the SSL/TLS protocols that encrypt syslog communication in transit and authenticate the remote peer. The driver package must be installed before rsyslog can select a TLS driver, so installing rsyslog-gnutls or rsyslog-openssl is the prerequisite for any encrypted forwarding configuration.

Solution

Install a rsyslog TLS network stream driver. Only one driver package is required; the GnuTLS driver is the recommended default.

Run the following command to install the rsyslog-gnutls package:

# dnf install rsyslog-gnutls

Or, if the OpenSSL driver is preferred, run the following command to install the rsyslog-openssl package:

# dnf install rsyslog-openssl

Impact:

Installing a TLS driver package enables, but does not by itself activate, encrypted forwarding; it must be paired with driver, CA, and (for mutual authentication) certificate configuration. Once TLS forwarding is enabled, ongoing certificate lifecycle management is required: an expired or misconfigured certificate or trust path will cause forwarding to fail until the trust chain is restored.

See Also

https://workbench.cisecurity.org/benchmarks/27890

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|14.4

Plugin: Unix

Control ID: 6db44939325d9cf7888e5e9b08e13303e5dfc870140179ad391685dd2b556b3a