AIX must implement a remote syslog server that is documented using site-defined procedures.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-215312	AIX7-00-002131	SV-215312r508663_rule		Medium

Description
If a remote log host is in use and it has not been justified and documented, sensitive information could be obtained by unauthorized users without the administrator’s knowledge. Satisfies: SRG-OS-000480-GPOS-00227, SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224

STIG	Date
IBM AIX 7.x Security Technical Implementation Guide	2021-03-10

Details

Check Text ( C-16510r294387_chk )
Examine the "syslog.conf" file for any references to remote log hosts using command: # grep -v "^#" /etc/syslog.conf \| grep '@' @ Ask ISSO/SA for a list of valid remote syslog servers justified and documented using site-defined procedures. Destination locations beginning with "@" represent log hosts. If the log host name is a local alias, such as log host, consult the "/etc/hosts" or other name databases as necessary to obtain the canonical name or address for the log host. Determine if the host referenced is a syslog host documented using site-defined procedures. If a loghost is not defined, not documented, or is commented out this is a finding.

Check Text ( C-16510r294387_chk )

Examine the "syslog.conf" file for any references to remote log hosts using command:

# grep -v "^#" /etc/syslog.conf | grep '@'
@

Ask ISSO/SA for a list of valid remote syslog servers justified and documented using site-defined procedures.

Destination locations beginning with "@" represent log hosts. If the log host name is a local alias, such as log host, consult the "/etc/hosts" or other name databases as necessary to obtain the canonical name or address for the log host. Determine if the host referenced is a syslog host documented using site-defined procedures.

If a loghost is not defined, not documented, or is commented out this is a finding.

Fix Text (F-16508r294388_fix)
Edit the /etc/syslog.conf file to include a documented and approved remote log host.