Enable syslog-ng Service

An XCCDF Rule

Description

The syslog-ng service (in replacement of rsyslog) provides syslog-style logging by default on Debian. The syslog-ng service can be enabled with the following command:

$ sudo systemctl enable syslog-ng.service

Rationale

The syslog-ng service must be running in order to provide logging services, which are essential to system administration.

ID: xccdf_org.ssgproject.content_rule_service_syslogng_enabled
Severity: Medium
References: 1 12 13 14 15 16 2 3 5 6 7 8 9

APO10.01 APO10.03 APO10.04 APO10.05 APO11.04 APO13.01 BAI03.05 BAI04.04 DSS01.03 DSS03.05 DSS05.02 DSS05.04 DSS05.05 DSS05.07 MEA01.01 MEA01.02 MEA01.03 MEA01.04 MEA01.05 MEA02.01

CCI-001311 CCI-001312 CCI-001557 CCI-001851

4.3.2.6.7 4.3.3.3.9 4.3.3.5.8 4.3.4.4.7 4.4.2.1 4.4.2.2 4.4.2.4

SR 2.10 SR 2.11 SR 2.12 SR 2.8 SR 2.9 SR 6.1 SR 6.2 SR 7.1 SR 7.2

A.12.1.3 A.12.4.1 A.12.4.2 A.12.4.3 A.12.4.4 A.12.7.1 A.14.2.7 A.15.2.1 A.15.2.2 A.17.2.1

AU-4(1) CM-6(a)

DE.CM-1 DE.CM-3 DE.CM-7 ID.SC-4 PR.DS-4 PR.PT-1
Updated: 5 days ago


[customizations.services]
enabled = ["syslog-ng"]

include enable_syslog-ng

class enable_syslog-ng {
  service {'syslog-ng':
    enable => true,
    ensure => 'running',  }
}

- name: Gather the package facts
  package_facts:
    manager: auto
  tags:
  - NIST-800-53-AU-4(1)
  - NIST-800-53-CM-6(a)  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_syslogng_enabled

- name: Enable syslog-ng Service - Enable service syslog-ng
  block:

  - name: Gather the package facts
    package_facts:
      manager: auto

  - name: Enable syslog-ng Service - Enable Service syslog-ng
    ansible.builtin.systemd:
      name: syslog-ng
      enabled: true
      state: started
      masked: false
    when:
    - '"syslog-ng" in ansible_facts.packages'
  when: '"kernel" in ansible_facts.packages'
  tags:
  - NIST-800-53-AU-4(1)
  - NIST-800-53-CM-6(a)
  - enable_strategy
  - low_complexity
  - low_disruption
  - medium_severity
  - no_reboot_needed
  - service_syslogng_enabled


service enable syslog-ng

# Remediation is applicable only in certain platforms
if rpm --quiet -q kernel; then

SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" unmask 'syslog-ng.service'
"$SYSTEMCTL_EXEC" start 'syslog-ng.service'"$SYSTEMCTL_EXEC" enable 'syslog-ng.service'

else
    >&2 echo 'Remediation is not applicable, nothing was done'
fi

Enable syslog-ng Service

Description

Rationale

Remediation - OS Build Blueprint

Remediation - Puppet

Remediation - Ansible

Remediation - script:kickstart

Remediation - Shell Script