Detections
Analytics
6.1.1.2 Ensure systemd-journal-remote service is not in use
Information
The systemd-journal-remote package, provides the ability to both send logs to a remote hosts and receive incoming logs from another host. There are two services; systemd-journal-remote.socket and systemd-journal-remote.service that provide the functionality of receiving logs from a remote server, thus acting as a log server. Clients should not receive data from other hosts.If a client is configured to also receive data, thus turning it into a server, the client system is acting outside it's operational boundary.
Solution
Run the following commands to stop and mask systemd-journal-remote.socket and systemd-journal-remote.service :# systemctl stop systemd-journal-remote.socket systemd-journal-remote.service
# systemctl mask systemd-journal-remote.socket systemd-journal-remote.service
See Also
Item Details
Audit Name: CIS Amazon Linux 2 v4.0.0 L1 Server
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-7, CSCv7|9.2
Plugin: Unix
Control ID: a5438ca14bb2059254aa87cda367bbdb537910dc24fded9bfe059d0d6f84f6f0