| name | cis-ubuntu2004-v300-6-2-2-1-2 |
| description | Ensure systemd-journal-upload authentication is configured |
| category | cis-logging |
| version | 3.0.0 |
| author | cyberstrike-official |
| tags | ["cis","ubuntu","linux","ubuntu-20.04","journald"] |
| cis_id | 6.2.2.1.2 |
| cis_benchmark | CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0 |
| tech_stack | ["ubuntu","linux"] |
| cwe_ids | [] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
6.2.2.1.2 Ensure systemd-journal-upload authentication is configured (Manual)
Profile
- Level 1 - Server
- Level 1 - Workstation
Description
Journald systemd-journal-upload supports the ability to send log events it gathers to a remote log host.
Rationale
Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system.
Note: This recommendation only applies if journald is the chosen method for client side logging. Do not apply this recommendation if rsyslog is used.
Audit Procedure
Command Line
Run the following command to verify systemd-journal-upload authentication is configured:
Example output:
/etc/systemd/journal-upload.conf.d/60-journald_upload.conf:URL=192.168.50.42
/etc/systemd/journal-upload.conf.d/60-journald_upload.conf:ServerKeyFile=/etc/ssl/private/journal-upload.pem
/etc/systemd/journal-upload.conf.d/60-journald_upload.conf:ServerCertificateFile=/etc/ssl/certs/journal-upload.pem
/etc/systemd/journal-upload.conf.d/60-journald_upload.conf:TrustedCertificateFile=/etc/ssl/ca/trusted.pem
Expected Result
Review the output to ensure it matches your environments' certificate locations and the URL of the log server.
Remediation
Command Line
Edit the /etc/systemd/journal-upload.conf file or a file in /etc/systemd/journal-upload.conf.d ending in .conf and ensure the following lines are set in the [Upload] section per your environment:
Example settings:
[Upload]
URL=192.168.50.42
ServerKeyFile=/etc/ssl/private/journal-upload.pem
ServerCertificateFile=/etc/ssl/certs/journal-upload.pem
TrustedCertificateFile=/etc/ssl/ca/trusted.pem
Run the following command to update the parameters in the service:
