Detections
Analytics

6.1.1.2 Ensure systemd-journal-remote is not in use

Information

The systemd-journal-remote package provides the ability to receive journal log entries from remote hosts over the network, which makes the receiving host a log server. The same package supplies both the sending and the receiving functions; the receiving side is handled by two units, systemd-journal-remote.socket and systemd-journal-remote.service.

If a client is configured to also receive log data, thus turning it into a log server, the client system is acting outside its operational boundary. Disabling the systemd-journal-remote receiver is collector hygiene that applies regardless of whether rsyslog or journald is the primary log path.

Solution

Run the following commands to stop and mask systemd-journal-remote.socket and systemd-journal-remote.service:

# systemctl stop systemd-journal-remote.socket systemd-journal-remote.service
# systemctl mask systemd-journal-remote.socket systemd-journal-remote.service

See Also

https://workbench.cisecurity.org/benchmarks/27892

Item Details

Category: AUDIT AND ACCOUNTABILITY, CONFIGURATION MANAGEMENT

References: 800-53|AU-2, 800-53|AU-7, 800-53|AU-12, 800-53|CM-6, 800-53|CM-7, CSCv7|9.2

Plugin: Unix

Control ID: 7634a3adeb5e6a793f67ae7197ec445baaf24b1d2c5f2b44119a9116b4eb5cf5