Detections
Analytics

6.1.2.9 Ensure rsyslog forwarding uses gtls

Information

Network stream drivers are a layer between various parts of rsyslogd (e.g. the imtcp module) and the transport layer. They provide sequenced delivery, authentication and confidentiality to the upper layers. Drivers implement different capabilities.

StreamDriver must be set to gtls to enable TLS for encrypting syslog traffic.

Solution

Edit rsyslog.conf or a .conf file in /etc/rsyslog.d/ to use gtls :

Example /etc/rsyslog.d/40-forward.conf

# certificate files - just CA for a client
global(DefaultNetstreamDriverCAFile="/path/to/contrib/gnutls/ca.pem")

# set up the action for all messages
action(type="omfwd" protocol="tcp" target="s.example.net" port="6514"
 StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="anon")

Impact:

Users need to know about netstream drivers because they need to configure the proper driver, and proper driver properties, to achieve desired results.

See Also

https://workbench.cisecurity.org/benchmarks/26893

Item Details

Category: ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1), CSCv7|14.4

Plugin: Unix

Control ID: 552ac744c89e411580ea71ee668bbfafc52c0e01d6d7339b3ba0127967a8f2d5