Skip to content
Log In

Install systemd-journal-remote Package

An XCCDF Rule

Description

Journald (via systemd-journal-remote ) supports the ability to send log events it gathers to a remote log host or to receive messages from remote hosts, thus enabling centralised log management.

Rationale

Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system.

ID
xccdf_org.ssgproject.content_rule_package_systemd-journal-remote_installed
Severity
Medium
References
Updated

Remediation Templates

script:kickstart

package install systemd-journal-remote

OS Build Blueprint

[[packages]]
name = "systemd-journal-remote"
version = "*"

script:bootc

dnf install systemd-journal-remote

A Puppet Snippet

include install_systemd-journal-remote
class install_systemd-journal-remote {
  package { 'systemd-journal-remote':
    ensure => 'installed',
  }
}

An Ansible Snippet

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - CCE-86467-8
  - enable_strategy

Anaconda Pre-Install Instructions

package --add=systemd-journal-remote

A Shell Script

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then
if ! rpm -q --quiet "systemd-journal-remote" ; then
    yum install -y "systemd-journal-remote"
fi