IBM AIX
TMA-AIX-8.2.2
Ensure syslog is configured to send logs to a remote log host
Descripción
This recommendation implements a remote syslog configuration. To further enhance the local syslog logging process CIS recommends that syslog information, in particular that generated by the auth facility, is logged remotely. This recommendation assumes that a remote and secure syslog server is available on the network. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.
Cómo se verifica
Método de auditoría: Comando de shell
[ -r /etc/syslog.conf ] || exit 1; n=$(grep -v "^[[:blank:]]*#" /etc/syslog.conf | grep -c "@"); [ "$n" -gt 0 ] && echo compliant || echo "no remote log host"- Salida esperada
compliant
Cómo se corrige
Método de corrección: Guía o parche de infraestructura
Explicitly define a remote host for auth.info data in /etc/syslog.conf (enter the remote host IP address in the example below): printf "auth.info\t\t@<IP address of remote syslog server>" >> /etc/syslog.conf NOTE: This ensures that remote login, sudo or su attempts are logged separately Create a remote host entry in /etc/syslog.conf to capture all other output of level info or higher (enter the remote host IP address in the example below): printf "*.info;auth.none\t@<IP address of remote syslog server>\n" >> /etc/syslog.conf Refresh syslogd to force the daemon to read the edited /etc/syslog.conf: refresh -s syslogd
Propiedades
- Sistemas operativos
- Cualquiera
- Etiquetas
- aixaudit
- Referencia
- CIS IBM AIX 7 Benchmark v1.2.0 - 8.2.2 Ensure syslog is configured to send logs to a remote log host
Verificar este host
Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.
tmaegis scan --target aix --level 2