Detections
Analytics
6.1.2.8 Ensure rsyslog-gnutls is installed
Information
TLS protocol support for rsyslog (GnuTLS). This netstream plugin allows rsyslog to send and receive encrypted syslog messages via the syslog-transport-tls IETF standard protocol using GnuTLS.Note: While this recommendation uses the GnuTLS stream driver (gtls / rsyslog-gnutls package), the OpenSSL stream driver (ossl / rsyslog-openssl package) is also an acceptable alternative. If using OpenSSL, replace DefaultNetstreamDriver gtls with DefaultNetstreamDriver ossl and ensure the rsyslog-openssl package is installed instead of rsyslog-gnutls.
Traditional syslog is a clear-text protocol that means anyone with a sniffer can have a peek at your data. rsyslog-gnutls is a secure communications library implementing the SSL, TLS and DTLS protocols and technologies around them, and provides an easy way to encrypt syslog communication.
Solution
Run the following command to install rsyslog-gnutls :# apt install rsyslog-gnutls
Impact:
Enabling TLS support using rsyslog-gnutls requires certificate management to ensure reliable encrypted logging. If misconfigured, remote log forwarding may fail until valid certificates and trusted CAs are applied.
See Also
Item Details
Audit Name: CIS Debian Linux 13 v1.1.0 L2 Workstation
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, CSCv7|6.2, CSCv7|6.3
Plugin: Unix
Control ID: 053b1f98db3c235f148160cd0783f51211f60b22efe7de4d4070e53a743e2984