Skip to content
Log In

Disable Network Console (netconsole)

An XCCDF Rule

Description

The netconsole service is responsible for loading the netconsole kernel module, which logs kernel printk messages over UDP to a syslog server. This allows debugging of problems where disk logging fails and serial consoles are impractical. The netconsole service can be disabled with the following command: 
$ sudo systemctl mask --now netconsole.service

Rationale

The netconsole service is not necessary unless there is a need to debug kernel panics, which is not common.

ID
xccdf_org.ssgproject.content_rule_service_netconsole_disabled
Severity
Low
References
Updated

Remediation Templates

A Kubernetes Patch

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
spec:
  config:
    ignition:
      version: 3.1.0

OS Build Blueprint

[customizations.services]
disabled = ["netconsole"]

An Ansible Snippet

- name: Block Disable service netconsole
  block:
  - name: Disable service netconsole
    block:

    - name: Disable service netconsole

A Shell Script

# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
SYSTEMCTL_EXEC='/usr/bin/systemctl'
"$SYSTEMCTL_EXEC" stop 'netconsole.service'
"$SYSTEMCTL_EXEC" disable 'netconsole.service'
"$SYSTEMCTL_EXEC" mask 'netconsole.service'

A Puppet Snippet

include disable_netconsole
class disable_netconsole {
  service {'netconsole':
    enable => false,
    ensure => 'stopped',
  }
}