Detections
Analytics
AZLX-23-002065 - Amazon Linux 2023 must authenticate the remote logging server for off-loading audit logs via rsyslog.
Information
Information stored in one location is vulnerable to accidental or incidental deletion or alteration.Solution
Configure Amazon Linux 2023 to authenticate the remote logging server for off-loading audit logs by setting the following option in "/etc/rsyslog.conf" or "/etc/rsyslog.d/[customfile].conf":$ActionSendStreamDriverAuthMode x509/name
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Amazon_Linux_2023_V1R3_STIG.zip
Item Details
Audit Name: DISA Amazon Linux 2023 STIG v1r3
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-4(1), CAT|II, CCI|CCI-001851, Rule-ID|SV-274077r1120219_rule, STIG-ID|AZLX-23-002065, Vuln-ID|V-274077
Plugin: Unix
Control ID: 335becd5f3ec2a76b07ad512a07c1a7fc112eb5a7f3bb7428626de285dcb90c6