Detections
Analytics
GEN005440 - The system must only use remote syslog servers (log hosts) that is justified and documented using site-defined procedures.
Information
If a remote log host is in use and it has not been justified and documented with the IAO, sensitive information could be obtained by unauthorized users without the SA's knowledge. A remote log host is any host to which the system is sending syslog messages over a network.NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
Remove or document the referenced undocumented log host.See Also
http://iasecontent.disa.mil/stigs/zip/U_RedHat_5_V1R18_STIG.zip
Item Details
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Group-ID|V-4395, Rule-ID|SV-37812r2_rule, STIG-ID|GEN005460, Vuln-ID|V-4395
Plugin: Unix
Control ID: 29a329c970feeb4e05dddfb3d94086d0c70553a259a3a7e8477e2735eab07c7c