Ensure Rsyslog Encrypts Off-Loaded Audit Records

An XCCDF Rule

Description

Rsyslogd is a system utility providing support for message logging. Support for both internet and UNIX domain sockets enables this utility to support both local and remote logging. Couple this utility with gnutls (which is a secure communications library implementing the SSL, TLS and DTLS protocols), and you have a method to securely encrypt and off-load auditing. When using rsyslogd to off-load logs off an encryption system must be used.

Rationale

The audit records generated by Rsyslog contain valuable information regarding system configuration, user authentication, and other such information. Audit records should be protected from unauthorized access.

ID: xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_defaultnetstreamdriver
Severity: Medium
References: CCI-001851

AU-4(1)

SRG-OS-000342-GPOS-00133 SRG-OS-000479-GPOS-00224

RHEL-08-030710

SV-230481r877390_rule

CCE-85992-6
Updated: about 1 year ago

- name: Ensure Rsyslog Encrypts Off-Loaded Audit Records
  block:

  - name: Deduplicate values from /etc/rsyslog.conf
    lineinfile:
      path: /etc/rsyslog.conf      create: false
      regexp: '^\s*{{ "$DefaultNetstreamDriver"| regex_escape }} '
      state: absent

  - name: Check if /etc/rsyslog.d exists
    stat:
      path: /etc/rsyslog.d
    register: _etc_rsyslog_d_exists

  - name: Check if the parameter $DefaultNetstreamDriver is present in /etc/rsyslog.d
    find:
      paths: /etc/rsyslog.d
      recurse: 'yes'
      follow: 'no'
      contains: '^\s*{{ "$DefaultNetstreamDriver"| regex_escape }} '
    register: _etc_rsyslog_d_has_parameter
    when: _etc_rsyslog_d_exists.stat.isdir is defined and _etc_rsyslog_d_exists.stat.isdir

  - name: Remove parameter from files in /etc/rsyslog.d
    lineinfile:
      path: '{{ item.path }}'
      create: false
      regexp: '^\s*{{ "$DefaultNetstreamDriver"| regex_escape }} '
      state: absent
    with_items: '{{ _etc_rsyslog_d_has_parameter.files }}'
    when: _etc_rsyslog_d_has_parameter.matched

  - name: Insert correct line to /etc/rsyslog.conf
    lineinfile:
      path: /etc/rsyslog.conf
      create: true
      regexp: '^\s*{{ "$DefaultNetstreamDriver"| regex_escape }} '
      line: $DefaultNetstreamDriver gtls
      state: present
  when: ansible_virtualization_type not in ["docker", "lxc", "openvz", "podman", "container"]
  tags:
  - CCE-85992-6
  - DISA-STIG-RHEL-08-030710
  - NIST-800-53-AU-4(1)
  - configure_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - rsyslog_encrypt_offload_defaultnetstreamdriver

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then

if [ -e "/etc/rsyslog.d/encrypt.conf" ] ; then
    
    LC_ALL=C sed -i "/^\s*\$DefaultNetstreamDriver /Id" "/etc/rsyslog.d/encrypt.conf"else
    touch "/etc/rsyslog.d/encrypt.conf"
fi
# make sure file has newline at the end
sed -i -e '$a\' "/etc/rsyslog.d/encrypt.conf"

cp "/etc/rsyslog.d/encrypt.conf" "/etc/rsyslog.d/encrypt.conf.bak"
# Insert at the end of the file
printf '%s\n' "\$DefaultNetstreamDriver gtls" >> "/etc/rsyslog.d/encrypt.conf"
# Clean up after ourselves.
rm "/etc/rsyslog.d/encrypt.conf.bak"

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Ensure Rsyslog Encrypts Off-Loaded Audit Records

Description

Rationale

Remediation - Ansible

Remediation - Shell Script