Data from journald may be stored in volatile memory or persisted locally.
Utilities exist to accept remote export of journald logs.
Rationale
Storing log data on a remote host protects log integrity from local attacks. If an attacker gains root access on the local system, they could tamper with or remove log data that is stored on the local system.
# Remediation is applicable only in certain platforms
if [ ! -f /.dockerenv ] && [ ! -f /run/.containerenv ]; then
function remove_journald_ForwardToSyslog_configuration {
local COMPONENT_PARAM_CONFIG
mapfile -t COMPONENT_PARAM_CONFIG < <(ls /etc/systemd/journal.d/*.conf)
COMPONENT_PARAM_CONFIG+=("/etc/systemd/journald.conf")
for f in "${COMPONENT_PARAM_CONFIG[@]}"
do
sed -i "/^\s*ForwardToSyslog\s*=\s*/d" "$f"
# make sure file has newline at the end
sed -i -e '$a\' "$f"
done
sed -i -e '$a\' "/etc/systemd/journald.conf"
}
function journald_ForwardToSyslog_add_configuration {
local COMPONENT_PARAM_REMEDY_CFG
mkdir -p "/etc/systemd/journal.d"
COMPONENT_PARAM_REMEDY_CFG="/etc/systemd/journal.d/oscap-remedy.conf"
if [ ! -f "${COMPONENT_PARAM_REMEDY_CFG}" ] ; then
touch "${COMPONENT_PARAM_REMEDY_CFG}"
fi
cp "${COMPONENT_PARAM_REMEDY_CFG}" "${COMPONENT_PARAM_REMEDY_CFG}.bak"
# Insert before the line matching the regex '^#\s*Compress'.
line_number="$(LC_ALL=C grep -n "^#\s*ForwardToSyslog" "${COMPONENT_PARAM_REMEDY_CFG}.bak" | LC_ALL=C sed 's/:.*//g')"
if [ -z "$line_number" ]; then
# There was no match of '^#\s*ForwardToSyslog', insert at
# the end of the file.
printf '%s\n' "ForwardToSyslog=yes" >> "${COMPONENT_PARAM_REMEDY_CFG}"
else
head -n "$(( line_number - 1 ))" "${COMPONENT_PARAM_REMEDY_CFG}.bak" > "${COMPONENT_PARAM_REMEDY_CFG}"
printf '%s\n' "ForwardToSyslog=yes" >> "/etc/systemd/journald.conf"
tail -n "+$(( line_number ))" "${COMPONENT_PARAM_REMEDY_CFG}.bak" >> "${COMPONENT_PARAM_REMEDY_CFG}"
fi
# Clean up after ourselves.
rm "${COMPONENT_PARAM_REMEDY_CFG}.bak"
}
remove_journald_ForwardToSyslog_configuration
journald_ForwardToSyslog_add_configuration
else
>&2 echo 'Remediation is not applicable, nothing was done'
fi
Remediation - Ansible
- name: Check for duplicate ForwardToSyslog values in master journald configuration
ansible.builtin.lineinfile:
path: /etc/systemd/journald.conf
create: false
regexp: ^\s*ForwardToSyslog=
state: absent