Install systemd-journal-remote Package
An XCCDF Rule
Description
Journald (via systemd-journal-remote ) supports the ability to send log events it gathers to a remote log host or to receive messages from remote hosts, thus enabling centralised log management.
Rationale
Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system.
- ID
- xccdf_org.ssgproject.content_rule_package_systemd-journal-remote_installed
- Severity
- Medium
- References
- Updated
Remediation - script:kickstart
package install systemd-journal-remote
Remediation - Ansible
- name: Ensure systemd-journal-remote is installed
package:
name: systemd-journal-remote
state: present
when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
tags:
Remediation - Anaconda Pre-Install Instructions
package --add=systemd-journal-remote
Remediation - Puppet
include install_systemd-journal-remote
class install_systemd-journal-remote {
package { 'systemd-journal-remote':
ensure => 'installed',
}
Remediation - OS Build Blueprint
[[packages]]
name = "systemd-journal-remote"
version = "*"
Remediation - Shell Script
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
if ! rpm -q --quiet "systemd-journal-remote" ; then
dnf install -y "systemd-journal-remote"
fi