UCF STIG Viewer Logo

The system must not be used as a syslog server (loghost) for systems external to the enclave.


Overview

Finding ID Version Rule ID IA Controls Severity
V-12020 GEN005440 SV-35187r1_rule ECSC-1 Medium
Description
Syslog messages are typically unencrypted and may contain sensitive information and are, therefore, restricted to the enclave.
STIG Date
HP-UX 11.31 Security Technical Implementation Guide 2018-09-14

Details

Check Text ( C-36623r2_chk )
The syslog server's /etc/syslog.conf file must have the client(s) listed along with the logging facility. The following example is a syslog.conf entry for the syslog client machine moe.larry.com:

+example.com
*.* /var/adm/log/example_com.log

NOTE: This will virtually always require a manual review. Ask the SA if the loghost server is collecting data for hosts outside the local enclave. If it is, this is a finding.
Fix Text (F-31990r2_fix)
Configure hosts outside of the local enclave to not log to this system.