cis-ubuntu1604-v200-4-2-1-1

name	cis-ubuntu1604-v200-4-2-1-1
description	Ensure rsyslog is installed
category	cis-logging
version	2.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-16.04","logging","rsyslog"]
cis_id	4.2.1.1
cis_benchmark	CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0 - Control 4.2.1.1

Profile

• Level: 1 - Server
• Level: 1 - Workstation
• Assessment Status: Automated

Description

The rsyslog software is a recommended replacement to the original syslogd daemon which provide improvements over syslogd, such as connection-oriented (i.e. TCP) transmission of logs, the option to log to database formats, and the encryption of log data en route to a central logging server.

Rationale

The security enhancements of rsyslog such as connection-oriented (i.e. TCP) transmission of logs, the option to log to database formats, and the encryption of log data en route to a central logging server) justify installing and configuring the package.

Impact

None.

Audit Procedure

Verify either rsyslog or syslog-ng is installed. Use the following command to provide the needed information:

Command Line

dpkg -s rsyslog

Expected Result

The command should return package information indicating rsyslog is installed.

Remediation

Install rsyslog:

Command Line

apt install rsyslog

Default Value

rsyslog is installed by default on Ubuntu 16.04.

References

None.

CIS Controls

Controls Version	Control	IG 1	IG 2	IG 3
v7	6.2 Activate audit logging Ensure that local logging has been enabled on all systems and networking devices.
v7	6.3 Enable Detailed Logging Enable system logging to include detailed information such as an event source, date, user, timestamp, source addresses, destination addresses, and other useful elements.