Detections
Analytics

6.1.2.7 Ensure rsyslog is not configured as a log server

Information

rsyslog can be configured to receive log messages from remote hosts over the network by loading a remote-input module (imtcp, imudp, imptcp, or imrelp) and starting a listener, which makes the host act as a central log server.

A general-purpose host that is not intended to be a central log collector should not run a syslog listener. Accepting remote log messages opens a network-facing service that increases the attack surface and exposes the host to remote log injection or poisoning (which can corrupt the local log store) and to resource exhaustion from unsolicited traffic. Only hosts explicitly designated and hardened as log servers should receive remote logs.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

- Should any active log server configuration be found by the audit, edit the file(s) where those directives appear - /etc/rsyslog.conf, a drop-in under /etc/rsyslog.d/, or any non-standard file identified by the audit's configuration discovery - and remove or comment out the remote-input module load, input, and run directives for all of imtcp, imudp, imptcp, and imrelp . Ensure none of the following entries are present:

advanced format

module(load="imtcp")
module(load="imudp")
module(load="imptcp")
module(load="imrelp")
input(type="imtcp" port="514")
input(type="imudp" port="514")
input(type="imptcp" port="514")
input(type="imrelp" port="2514")

deprecated legacy format

$ModLoad imtcp
$ModLoad imudp
$ModLoad imptcp
$ModLoad imrelp
$InputTCPServerRun 514
$UDPServerRun 514
$InputPTCPServerRun 514
$InputRELPServerRun 2514

 - Run the following command to restart rsyslog :

# systemctl restart rsyslog

Impact:

None for a host that is not intended to receive remote logs. A host intentionally deployed as a central log server is outside the scope of this recommendation and should not apply it.

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: 307c92eeeb3b5088c7e27fdcfb9737f8a559793af30a08869a2f5460257f9e43