Guide to the Secure Configuration of Red Hat Enterprise Linux 8
Rules, Groups, and Values defined within the XCCDF Benchmark
-
Disable Logwatch on Clients if a Logserver Exists
Does your site have a central logserver which has been configured to report on logs received from all systems? If so: <pre>$ sudo rm /etc/cron.daily/0logwatch</pre> If no logserver exists, it will ...Rule Unknown Severity -
Ensure rsyslog Default File Permissions Configured
rsyslog will create logfiles that do not already exist on the system. This settings controls what permissions will be applied to these newly created files.Rule Medium Severity -
Configure Logwatch SplitHosts Line
If <code>SplitHosts</code> is set, Logwatch will separate entries by hostname. This makes the report longer but significantly more usable. If it is not set, then Logwatch will not report which host...Rule Unknown Severity -
Ensure cron Is Logging To Rsyslog
Cron logging must be implemented to spot intrusions or trace cron job status. If <code>cron</code> is not logging to <code>rsyslog</code>, it can be implemented by adding the following to the <i>RU...Rule Medium Severity -
Ensure Rsyslog Encrypts Off-Loaded Audit Records
Rsyslogd is a system utility providing support for message logging. Support for both internet and UNIX domain sockets enables this utility to support both local and remote logging. Couple this uti...Rule Medium Severity -
Ensure Rsyslog Encrypts Off-Loaded Audit Records
Rsyslogd is a system utility providing support for message logging. Support for both internet and UNIX domain sockets enables this utility to support both local and remote logging. Couple this uti...Rule Medium Severity -
Ensure System Log Files Have Correct Permissions
The file permissions for all log files written by <code>rsyslog</code> should be set to 640, or more restrictive. These log files are determined by the second part of each Rule line in <code>/etc/r...Rule Medium Severity -
Ensure logging is configured
The/etc/rsyslog.confand/etc/rsyslog.d/*.conffiles specifies rules for logging and which files are to be used to log certain classes of messages.Rule Medium Severity -
systemd-journald
systemd-journald is a system service that collects and stores logging data. It creates and maintains structured, indexed journals based on logging information that is received from a variety of sou...Group -
Install systemd-journal-remote Package
Journald (via systemd-journal-remote ) supports the ability to send log events it gathers to a remote log host or to receive messages from remote hosts, thus enabling centralised log management.Rule Medium Severity
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.
Capacity
Modules