SUSE Linux Enterprise Micro 5 must offload rsyslog messages for networked systems in real time and
offload standalone systems at least weekly
Rationale
Information stored in one location is vulnerable to accidental or incidental deletion or alteration.
Offloading is a common process in information systems with limited audit storage capacity
# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel-default; then
var_journal_upload_server_key_file='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_journal_upload_server_key_file" use="legacy"/>'
# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^ServerKeyFile")
# shellcheck disable=SC2059
printf -v formatted_output "%s=%s" "$stripped_key" "$var_journal_upload_server_key_file"
# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^ServerKeyFile\\>" "/etc/systemd/journal-upload.conf"; then
escaped_formatted_output=$(sed -e 's|/|\\/|g' <<< "$formatted_output")
LC_ALL=C sed -i --follow-symlinks "s/^ServerKeyFile\\>.*/$escaped_formatted_output/gi" "/etc/systemd/journal-upload.conf"
else
if [[ -s "/etc/systemd/journal-upload.conf" ]] && [[ -n "$(tail -c 1 -- "/etc/systemd/journal-upload.conf" || true)" ]]; then
LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/systemd/journal-upload.conf"
fi
cce="CCE-94080-9"
printf '# Per %s: Set %s in %s\n' "${cce}" "${formatted_output}" "/etc/systemd/journal-upload.conf" >> "/etc/systemd/journal-upload.conf"
printf '%s\n' "$formatted_output" >> "/etc/systemd/journal-upload.conf"
fi
var_journal_upload_server_certificate_file='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_journal_upload_server_certificate_file" use="legacy"/>'
# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^ServerCertificateFile")
# shellcheck disable=SC2059
printf -v formatted_output "%s=%s" "$stripped_key" "$var_journal_upload_server_certificate_file"
# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^ServerCertificateFile\\>" "/etc/systemd/journal-upload.conf"; then
escaped_formatted_output=$(sed -e 's|/|\\/|g' <<< "$formatted_output")
LC_ALL=C sed -i --follow-symlinks "s/^ServerCertificateFile\\>.*/$escaped_formatted_output/gi" "/etc/systemd/journal-upload.conf"
else
if [[ -s "/etc/systemd/journal-upload.conf" ]] && [[ -n "$(tail -c 1 -- "/etc/systemd/journal-upload.conf" || true)" ]]; then
LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/systemd/journal-upload.conf"
fi
cce="CCE-94080-9"
printf '# Per %s: Set %s in %s\n' "${cce}" "${formatted_output}" "/etc/systemd/journal-upload.conf" >> "/etc/systemd/journal-upload.conf"
printf '%s\n' "$formatted_output" >> "/etc/systemd/journal-upload.conf"
fi
var_journal_upload_server_trusted_certificate_file='<xccdf-1.2:sub xmlns:xccdf-1.2="http://checklists.nist.gov/xccdf/1.2" idref="xccdf_org.ssgproject.content_value_var_journal_upload_server_trusted_certificate_file" use="legacy"/>'
# Strip any search characters in the key arg so that the key can be replaced without
# adding any search characters to the config file.
stripped_key=$(sed 's/[\^=\$,;+]*//g' <<< "^TrustedCertificateFile")
# shellcheck disable=SC2059
printf -v formatted_output "%s=%s" "$stripped_key" "$var_journal_upload_server_trusted_certificate_file"
# If the key exists, change it. Otherwise, add it to the config_file.
# We search for the key string followed by a word boundary (matched by \>),
# so if we search for 'setting', 'setting2' won't match.
if LC_ALL=C grep -q -m 1 -i -e "^TrustedCertificateFile\\>" "/etc/systemd/journal-upload.conf"; then
escaped_formatted_output=$(sed -e 's|/|\\/|g' <<< "$formatted_output")
LC_ALL=C sed -i --follow-symlinks "s/^TrustedCertificateFile\\>.*/$escaped_formatted_output/gi" "/etc/systemd/journal-upload.conf"
else
if [[ -s "/etc/systemd/journal-upload.conf" ]] && [[ -n "$(tail -c 1 -- "/etc/systemd/journal-upload.conf" || true)" ]]; then
LC_ALL=C sed -i --follow-symlinks '$a'\\ "/etc/systemd/journal-upload.conf"
fi
cce="CCE-94080-9"
printf '# Per %s: Set %s in %s\n' "${cce}" "${formatted_output}" "/etc/systemd/journal-upload.conf" >> "/etc/systemd/journal-upload.conf"
printf '%s\n' "$formatted_output" >> "/etc/systemd/journal-upload.conf"
fi
else
>&2 echo 'Remediation is not applicable, nothing was done'
fi