Detections
Analytics

8.2.3 Ensure syslog is not configured to receive logs from a remote client

Information

This recommendation prevents the local syslogd daemon from accepting messages from other hosts on the network. Only central syslog servers, should accept remote syslog messages.

By default the syslogd daemon accepts all remote syslog messages as no authentication is required. This means that a hacker could flood a server with syslog messages and potentially fill up the /var filesystem.

Solution

If the server does not act as a central syslog server, suppress the logging of messages originating from remote servers:

# /usr/bin/chssys -s syslogd -a "-r"

Re-cycle syslogd to activate the configuration change:

# /usr/bin/stopsrc -s syslogd
# /usr/bin/startsrc -s syslogd

See Also

https://workbench.cisecurity.org/benchmarks/22751

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-9(2)

Plugin: Unix

Control ID: f276d912a9ee94bb44d35fbf7bf5b90ca04aeb07acafc55ef673f0b7f9c64a8e