Ensure journald is configured to write log files to persistent disk

An XCCDF Rule

Description

The journald system may store log files in volatile memory or locally on disk. If the logs are only stored in volatile memory they will we lost upon reboot.

Rationale

Log files contain valuable data and need to be persistent to aid in possible investigations.

ID: xccdf_org.ssgproject.content_rule_journald_storage
Severity: Medium
Updated: about 1 year ago

- name: Check for duplicate Storage values in master journald configuration
  ansible.builtin.lineinfile:
    path: /etc/systemd/journald.conf
    create: false
    regexp: ^\s*Storage=
    state: absent  check_mode: true
  changed_when: false
  register: dupes_master
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - journald_storage
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Deduplicate Storage values from journald master configuration
  ansible.builtin.lineinfile:
    path: /etc/systemd/journald.conf
    create: false
    regexp: ^\s*Storage=
    state: absent
  when:
  - ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  - dupes_master.found is defined and dupes_master.found > 1
  tags:
  - journald_storage
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Collect all config journald files which configure Storage
  ansible.builtin.find:
    paths: /etc/systemd/journald.conf.d
    contains: ^[\s]*Storage=.*$
    patterns: '*.conf'
  register: journald_Storage_dropin_config_files
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - journald_storage
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Deduplicate values from journald Storage dropin configuration
  ansible.builtin.lineinfile:
    path: '{{ item.path }}'
    create: false
    regexp: ^\s*Storage=
    state: absent
  loop: '{{  journald_Storage_dropin_config_files.files }}'
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - journald_storage
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

- name: Insert correct line to journald Storage configuration
  ansible.builtin.lineinfile:
    path: /etc/systemd/journald.conf.d/oscap-remedy.conf
    create: true
    regexp: ^\s*Storage=
    line: Storage=persistent
    state: present
    insertbefore: ^# Storage
    validate: bash -n %s
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - journald_storage
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - restrict_strategy

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

function remove_journald_Storage_configuration {
    local COMPONENT_PARAM_CONFIG
    mapfile -t COMPONENT_PARAM_CONFIG < <(ls /etc/systemd/journald.conf.d/*.conf)    COMPONENT_PARAM_CONFIG+=("/etc/systemd/journald.conf")

    for f in "${COMPONENT_PARAM_CONFIG[@]}"
    do
        sed -i "/^\s*Storage\s*=\s*/d" "$f"
        # make sure file has newline at the end
        sed -i -e '$a\' "$f"
    done
    sed -i -e '$a\' "/etc/systemd/journald.conf"
}

function journald_Storage_add_configuration {
    local COMPONENT_PARAM_REMEDY_CFG
    mkdir -p "/etc/systemd/journald.conf.d"
    COMPONENT_PARAM_REMEDY_CFG="/etc/systemd/journald.conf.d/oscap-remedy.conf"

    if [ ! -f "${COMPONENT_PARAM_REMEDY_CFG}" ] ; then
        touch "${COMPONENT_PARAM_REMEDY_CFG}"
    fi
    cp "${COMPONENT_PARAM_REMEDY_CFG}" "${COMPONENT_PARAM_REMEDY_CFG}.bak"
    # Insert before the line matching the regex '^#\s*Compress'.
    line_number="$(LC_ALL=C grep -n "^#\s*Storage" "${COMPONENT_PARAM_REMEDY_CFG}.bak" | LC_ALL=C sed 's/:.*//g')"
    if [ -z "$line_number" ]; then
       # There was no match of '^#\s*Storage', insert at
       # the end of the file.
       printf '%s\n' "Storage=persistent" >> "${COMPONENT_PARAM_REMEDY_CFG}"
    else
        head -n "$(( line_number - 1 ))" "${COMPONENT_PARAM_REMEDY_CFG}.bak" > "${COMPONENT_PARAM_REMEDY_CFG}"
        printf '%s\n' "Storage=persistent" >> "/etc/systemd/journald.conf"
        tail -n "+$(( line_number ))" "${COMPONENT_PARAM_REMEDY_CFG}.bak" >> "${COMPONENT_PARAM_REMEDY_CFG}"
    fi
    # Clean up after ourselves.
    rm "${COMPONENT_PARAM_REMEDY_CFG}.bak"
}

remove_journald_Storage_configuration
journald_Storage_add_configuration

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Ensure journald is configured to write log files to persistent disk

Description

Rationale

Remediation - Ansible

Remediation - Shell Script