cis-ubuntu2004-v300-6-2-3-6

name	cis-ubuntu2004-v300-6-2-3-6
description	Ensure rsyslog is configured to send logs to a remote log host
category	cis-logging
version	3.0.0
author	cyberstrike-official
tags	["cis","ubuntu","linux","ubuntu-20.04","rsyslog"]
cis_id	6.2.3.6
cis_benchmark	CIS Ubuntu Linux 20.04 LTS Benchmark v3.0.0
tech_stack	["ubuntu","linux"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

6.2.3.6 Ensure rsyslog is configured to send logs to a remote log host (Manual)

Profile

• Level 1 - Server
• Level 1 - Workstation

Description

rsyslog supports the ability to send log events it gathers to a remote log host or to receive messages from remote hosts, thus enabling centralized log management.

Rationale

Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system.

Audit Procedure

Command Line

Run the following command and review the output of rsyslog configuration. Verify that logs are sent to a central host used by your organization:

basic format:

# grep "^.*[^I][^I]*@" /etc/rsyslog.conf /etc/rsyslog.d/*.conf

Output should include @@<FQDN or IP of remote loghost>, for example:

*.* @@loghost.example.com

Output should include @@<FQDN or IP of remote loghost>:

Example output:

/etc/rsyslog.d/60-rsyslog.conf:*.* @@loghost.example.com

• OR -

Run the following command and review the output of rsyslog configuration. Verify that logs are sent to a central host used by your organization:

advanced format:

# grep -E '^\s*([^#]+\s+)?action\(([^#]+\s+)?\btarget=\"?[^#"]+\"?\b' /etc/rsyslog.conf /etc/rsyslog.d/*.conf

Output should include target=<FQDN or IP of remote loghost>:

Example output:

/etc/rsyslog.d/60-rsyslog.conf:*.* action(type="omfwd" target="loghost.example.com" port="514" protocol="tcp"

Expected Result

Verify logs are being sent to a remote log host.

Remediation

Command Line

Edit the rsyslog configuration and add the following line (where loghost.example.com is the name of your central log host). The target directive may either be a fully qualified domain name or an IP address.

*.* action(type="omfwd" target="192.168.2.100" port="514" protocol="tcp"
        action.resumeRetryCount="100"
        queue.type="linkedList" queue.size="1000")