Detections
Analytics

GEN005460 - The system must only use remote syslog servers (log hosts) justified and documented using site-defined procedures.

Information

If a remote log host is in use and it has not been justified and documented with the IAO, sensitive information could be obtained by unauthorized users without the SA's knowledge. A remote log host is any host to which the system is sending syslog messages over a network.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Remove, replace, or document the referenced undocumented log host.

See Also

http://iasecontent.disa.mil/stigs/zip/U_STIG_Library_2015_07.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-4395r2_rule, STIG-ID|GEN005450, Vuln-ID|V-4395

Plugin: Unix

Control ID: b5be1f1f48bf23fe5ffe58e2ed684be0e6c56113b1586c27ce37042137d9455f