cis-ubuntu-14-04-lts-4-2-1-2-ensure-logging-is-configured

name	CIS Ubuntu 14.04 LTS - 4.2.1.2 Ensure logging is configured
description	Configure rsyslog to capture appropriate logging for all facilities
category	cis-os-hardening
version	2.1.0
author	cyberstrike-official
tags	["cis","ubuntu","ubuntu-14.04","level-1","not-scored","rsyslog","logging"]
cis_id	4.2.1.2
cis_benchmark	CIS Ubuntu Linux 14.04 LTS Benchmark v2.1.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	medium

4.2.1.2 Ensure logging is configured (Not Scored)

Profile Applicability

• Level 1 - Server
• Level 1 - Workstation

Description

The /etc/rsyslog.conf and /etc/rsyslog.d/*.conf files specifies rules for logging and which files are to be used to log certain classes of messages.

Rationale

A great deal of important security-related information is sent via rsyslog (e.g., successful and failed su attempts, failed login attempts, root login attempts, etc.).

Audit Procedure

Review the contents of the /etc/rsyslog.conf and /etc/rsyslog.d/*.conf files to ensure appropriate logging is set. In addition, run the following command and verify that the log files are logging information:

ls -l /var/log/

Expected Result

Log files should exist and contain recent entries for all configured facilities.

Remediation

Edit the following lines in the /etc/rsyslog.conf and /etc/rsyslog.d/*.conf files as appropriate for your environment:

*.emerg                                 :omusrmsg:*
mail.*                                  -/var/log/mail
mail.info                               -/var/log/mail.info
mail.warning                            -/var/log/mail.warn
mail.err                                 /var/log/mail.err
news.crit                               -/var/log/news/news.crit
news.err                                -/var/log/news/news.err
news.notice                             -/var/log/news/news.notice
*.=warning;*.=err                       -/var/log/warn
*.crit                                   /var/log/warn
*.*;mail.none;news.none                 -/var/log/messages
local0,local1.*                         -/var/log/localmessages
local2,local3.*                         -/var/log/localmessages
local4,local5.*                         -/var/log/localmessages
local6,local7.*                         -/var/log/localmessages

Run the following command to reload the rsyslogd configuration:

pkill -HUP rsyslogd

Default Value

Basic logging is configured by default.

References

1. See the rsyslog.conf(5) man page for more information.

Profile

• Level 1 - Server
• Level 1 - Workstation