The Oracle Linux operating system must send rsyslog output to a log aggregation server.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-221835	OL07-00-031000	SV-221835r917854_rule		Medium

Description
Sending rsyslog output to another system ensures that the logs cannot be removed or modified in the event that the system is compromised or has a hardware failure.

STIG	Date
Oracle Linux 7 Security Technical Implementation Guide	2023-06-02

Details

Check Text ( C-23550r917852_chk )
Verify "rsyslog" is configured to send all messages to a log aggregation server. Check the configuration of "rsyslog" with the following command: Note: If another logging package is used, substitute the utility configuration file for "/etc/rsyslog.conf". # grep @ /etc/rsyslog.conf /etc/rsyslog.d/.conf .* @@[logaggregationserver.example.mil]:[port] If there are no lines in the "/etc/rsyslog.conf" or "/etc/rsyslog.d/*.conf" files that contain the "@" or "@@" symbol(s), and the lines with the correct symbol(s) to send output to another system do not cover all "rsyslog" output, ask the system administrator to indicate how the audit logs are offloaded to a different system or media. If the lines are commented out or there is no evidence that the audit logs are being sent to another system, this is a finding.

Check Text ( C-23550r917852_chk )

Verify "rsyslog" is configured to send all messages to a log aggregation server.

Check the configuration of "rsyslog" with the following command:

Note: If another logging package is used, substitute the utility configuration file for "/etc/rsyslog.conf".

# grep @ /etc/rsyslog.conf /etc/rsyslog.d/*.conf

*.* @@[logaggregationserver.example.mil]:[port]

If there are no lines in the "/etc/rsyslog.conf" or "/etc/rsyslog.d/*.conf" files that contain the "@" or "@@" symbol(s), and the lines with the correct symbol(s) to send output to another system do not cover all "rsyslog" output, ask the system administrator to indicate how the audit logs are offloaded to a different system or media.

If the lines are commented out or there is no evidence that the audit logs are being sent to another system, this is a finding.

Fix Text (F-23539r917853_fix)
Modify the "/etc/rsyslog.conf" or an "/etc/rsyslog.d/.conf" file to contain a configuration line to send all "rsyslog" output to a log aggregation server: For UDP: .* @[logaggregationserver.example.mil]:[port] For TCP: . @@[logaggregationserver.example.mil]:[port]