Configure TLS for rsyslog remote logging
An XCCDF Rule
Description
Configure rsyslog to use Transport Layer
Security (TLS) support for logging to remote server
for the Forwarding Output Module in /etc/rsyslog.conf
using action. You can use the following command:
echo 'action(type="omfwd" protocol="tcp" Target="<remote system>" port="6514"
StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name" streamdriver.CheckExtendedKeyPurpose="on")' >> /etc/rsyslog.conf
Replace the <remote system> in the above command with an IP address or a host name of the remote logging server.
Rationale
For protection of data being logged, the connection to the remote logging server needs to be authenticated and encrypted.
- ID
- xccdf_org.ssgproject.content_rule_rsyslog_remote_tls
- Severity
- Medium
- References
- Updated