Ensure rsyslog network forwarding uses TLS

BaixaNível 2Automatizadalinux

Descrição

When rsyslog forwards logs to a remote host, the omfwd output action can wrap the connection in TLS by selecting a TLS network stream driver (gtls or ossl), running that driver in TLS-only mode, and setting a peer authentication mode. The driver may be selected globally (DefaultNetstreamDriver) or per action (StreamDriver), using either the modern advanced (global(...) / action(...)) syntax or the legacy $-directive syntax. This recommendation applies only where rsyslog forwards to a remote host; hosts that do not forward syslog over the network may document it as Not Applicable.

Como é verificado

Método de auditoria: Comando shell

shell

alt0() { o=$(bash -c 'grep -Psoih -- '"'"'^\h*(?:\$IncludeConfig\h+|include\h*\(\h*file\h*=\h*"?)\K[^")\h]+'"'"' /etc/rsyslog.conf /etc/rsyslog.d/*.conf' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'On a system that uses only the standard configuration paths, nothing is returned.' || { echo step1: missing 'On a system that uses only the standard configuration paths,'; return 1; }; o=$(bash -c 'grep -Psi -- '"'"'^[^#]*(StreamDriver|DefaultNetstreamDriver)(\.Name)?\s*[= ]\s*"?(gtls|ossl)"?'"'"' /etc/rsyslog.conf /etc/rsyslog.d/*.conf' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'A line setting the driver to gtls or ossl should be returned (for example' || { echo step2: missing 'A line setting the driver to gtls or ossl should be returned'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'StreamDriver="gtls", or the legacy $DefaultNetstreamDriver gtls).' || { echo step2: missing 'StreamDriver="gtls", or the legacy $DefaultNetstreamDriver g'; return 1; }; o=$(bash -c 'grep -Psi -- '"'"'^[^#]*(StreamDriverMode\s*=\s*"?1"?|ActionSendStreamDriverMode\s+1)'"'"' /etc/rsyslog.conf /etc/rsyslog.d/*.conf' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'A line setting the driver mode to 1 should be returned (for example' || { echo step3: missing 'A line setting the driver mode to 1 should be returned (for '; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'StreamDriverMode="1", or the legacy $ActionSendStreamDriverMode 1).' || { echo step3: missing 'StreamDriverMode="1", or the legacy $ActionSendStreamDriverM'; return 1; }; o=$(bash -c 'grep -Psi -- '"'"'^[^#]*(StreamDriverAuthMode\s*=\s*"?(x509/name|x509/certvalid|x509/fingerpri nt|anon)"?|ActionSendStreamDriverAuthMode\s+(x509/name|x509/certvalid|x509/fi ngerprint|anon))'"'"' /etc/rsyslog.conf /etc/rsyslog.d/*.conf' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'A line setting the authentication mode should be returned (for example' || { echo step4: missing 'A line setting the authentication mode should be returned (f'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'StreamDriverAuthMode="x509/name", or the legacy' || { echo step4: missing 'StreamDriverAuthMode="x509/name", or the legacy'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '$ActionSendStreamDriverAuthMode x509/name). x509/name is recommended' || { echo step4: missing '$ActionSendStreamDriverAuthMode x509/name). x509/name is rec'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'because it validates the remote certificate chain and matches the peer identity; anon' || { echo step4: missing 'because it validates the remote certificate chain and matche'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'encrypts but does not authenticate the peer and should be avoided in production.' || { echo step4: missing 'encrypts but does not authenticate the peer and should be av'; return 1; }; o=$(bash -c 'grep -Psi -- '"'"'^[^#]*(port\s*=\s*"?6514"?|:6514)'"'"' /etc/rsyslog.conf /etc/rsyslog.d/*.conf' 2>&1); printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- 'A line targeting port 6514 should be returned (for example port="6514", or the legacy' || { echo step5: missing 'A line targeting port 6514 should be returned (for example p'; return 1; }; printf '%s\n' "$o" | tr -s ' \t' '  ' | sed 's/^ //;s/ $//' | grep -Fxq -- '@@loghost:6514).' || { echo step5: missing '@@loghost:6514).'; return 1; }; }; if alt0; then echo compliant; fi

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Configure rsyslog to forward over TLS using a drop-in file, the recommended method for local rsyslog configuration, and ensure no plaintext forwarding action remains. 1. Run the following command to locate any existing forwarding actions for review: # grep -PHns -- 'type="omfwd"|^\h*[^#]*@' /etc/rsyslog.conf /etc/rsyslog.d/*.conf 2. In each file returned, remove or convert to TLS any forwarding action that is not already TLS-secured, so the only remaining forwarding path uses TLS. 3. Create a drop-in file such as /etc/rsyslog.d/60-forward-tls.conf with the TLS forwarding configuration. The example below uses the GnuTLS driver: # Select the TLS driver and trust material globally global( Defau…

Propriedades

Sistemas operacionais: rocky-9
Tags: cis-convertedlinux
Referência: CIS Rocky Linux 9 Benchmark v3.0.0 - 6.1.2.11

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target linux --level 2