Detections
Analytics

1.85 AZLX-23-002070

Information

Amazon Linux 2023 must encrypt the transfer of audit records off-loaded onto a different system or media from the system being audited via rsyslog.

GROUP ID: V-274078RULE ID: SV-274078r1120222

Information stored in one location is vulnerable to accidental or incidental deletion or alteration.

Solution

Configure Amazon Linux 2023 to encrypt off-loaded audit records via rsyslog by setting the following options in "/etc/rsyslog.conf" or "/etc/rsyslog.d/[customfile].conf":

$ActionSendStreamDriverMode 1

See Also

https://workbench.cisecurity.org/benchmarks/26107

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-4(1), CAT|II, CCI|CCI-001851, Rule-ID|SV-274078r1120222_rule, STIG-ID|AZLX-23-002070, Vuln-ID|V-274078

Plugin: Unix

Control ID: e9dd7eedc8bfe40ea497bb464e2634add88332f26f9037e1432b50536294f59c