Detections
Analytics

6.1.1.1.2 Ensure systemd-journal-remote service is not in use

Information

Journald systemd-journal-remote supports the ability to receive messages from remote hosts, thus acting as a log server. Clients should not receive data from other hosts.

Note:

 - The same package, systemd-journal-remote, is used for both sending logs to remote hosts and receiving incoming logs.
 - With regards to receiving logs, there are two services; systemd-journal-remote.socket and systemd-journal-remote.service.

If a client is configured to also receive data, thus turning it into a server, the client system is acting outside it's operational boundary.

Note: This recommendation only applies if journald is the chosen method for client side logging . Do not apply this recommendation if rsyslog is used.

Solution

Run the following commands to stop and mask systemd-journal-remote.socket and systemd-journal-remote.service:

# systemctl stop systemd-journal-remote.socket systemd-journal-remote.service
# systemctl mask systemd-journal-remote.socket systemd-journal-remote.service

See Also

https://workbench.cisecurity.org/benchmarks/26893

Item Details

Category: AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: 9c873b1d4c781f6fbae915ab6d88977c0c3823a4aee732aa048ac58de55b3c5b