Detections
Analytics

6.1.2.10 Ensure rsyslog CA certificates are configured

Information

When rsyslog forwards log data to a remote host over TLS, it uses a Certificate Authority (CA) certificate to verify the authenticity of the remote server's TLS certificate. The CA certificate is specified using the DefaultNetstreamDriverCAFile global option in rsyslog configuration.

Configuring a trusted CA certificate ensures that rsyslog only connects to log servers whose TLS certificates are signed by a known, trusted authority. Without a properly configured CA certificate, log forwarding may proceed without server identity verification, exposing the system to man-in-the-middle attacks that could intercept, tamper with, or silently discard forwarded log data. This could result in undetected data leakage or loss of audit trail integrity.

Solution

Edit /etc/rsyslog.conf or a .conf file in /etc/rsyslog.d/ to configure the correct path to the CA certificate file:

Example using the system CA bundle:

global(DefaultNetstreamDriverCAFile="/etc/ssl/certs/ca-certificates.crt")

Example using a dedicated CA certificate:

global(DefaultNetstreamDriverCAFile="/etc/rsyslog/tls/ca.pem")

After editing, restart rsyslog to apply the change:

# systemctl restart rsyslog

Impact:

Proper certificate management is required. If the CA certificate file is missing, expired, or points to an incorrect path, TLS-encrypted log forwarding will fail until the trust chain is restored. Self-signed certificates should not be used as the CA certificate for production environments.

See Also

https://workbench.cisecurity.org/benchmarks/26891

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|AC-17(2), 800-53|AU-6(3), 800-53|IA-5, 800-53|IA-5(1), 800-53|SC-8, 800-53|SC-8(1)

Plugin: Unix

Control ID: f799b3619a8f053aaf77bc7a2e09a1d4e4d8d31e321c5d6c54414953b81c9e57