AlmaLinux OS 9 must authenticate the remote logging server for offloading audit logs via rsyslog.
An XCCDF Rule
Description
Information stored in one location is vulnerable to accidental or incidental deletion or alteration. Off-loading is a common process in information systems with limited audit storage capacity.
- ID
- SV-269513r1050396_rule
- Version
- ALMA-09-052600
- Severity
- Medium
- References
- Updated
Remediation Templates
A Manual Procedure
Configure AlmaLinux OS 9 to authenticate the remote logging server for offloading audit logs by setting the following option in "/etc/rsyslog.conf" or "/etc/rsyslog.d/[customfile].conf":
$ActionSendStreamDriverAuthMode x509/name