NixOS must authenticate the remote logging server for off-loading audit logs.

An XCCDF Rule

Description

Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity. NixOS supports "syslog-ng". "syslog-ng" is a common system utility providing support for message logging. Support for both internet and Unix domain sockets enables this utility to support both local and remote logging. This utility also natively supports TLS to securely encrypt and off-load auditing. Satisfies: SRG-OS-000051-GPOS-00024, SRG-OS-000342-GPOS-00133, SRG-OS-000479-GPOS-00224

ID: SV-268109r1039595_rule
Version: ANIX-00-000490
Severity: Medium
References: CCI-000154 CCI-001851
Updated: about 2 months ago

Remediation Templates

Configure the operating system to authenticate the remote logging server for off-loading audit logs.

Add or update the "services.syslog-ng.extraConfig" configuration in /etc/nixos/configuration.nix to include the following:

  destination d_network {
   syslog(    "<remote-logging-server>" port(<port>)
    transport(tls)
    tls(
     cert-file("/var/syslog-ng/certs.d/certificate.crt")
     key-file("/var/syslog-ng/certs.d/certificate.key")
     ca-file("/var/syslog-ng/certs.d/cert-bundle.crt")
     peer-verify(yes)
    )
   );
  };

  log { source(s_local); destination(d_local); destination(d_network); };

For example, an updated configuration of 'services.rsyslogd.extraConfig' would look like the following in /etc/nixos/configuration.nix ('...' denoting that the 'services.rsyslogd.extraConfig' configuration may have other options configured):

 services.rsyslogd.extraConfig = ''
   ...
   destination d_network {
    syslog(
     "<remote-logging-server>" port(<port>)
     transport(tls)
     tls(
      cert-file("/var/syslog-ng/certs.d/certificate.crt")
      key-file("/var/syslog-ng/certs.d/certificate.key")
      ca-file("/var/syslog-ng/certs.d/cert-bundle.crt")
      peer-verify(yes)
     )
    );
   };

   log { source(s_local); destination(d_local); destination(d_network); };
   ...
  '';

Rebuild the NixOS configuration with the following command:

$ sudo nixos-rebuild switch

NixOS must authenticate the remote logging server for off-loading audit logs.

Description

Remediation Templates

A Manual Procedure