Ensure syslog is configured to send logs to a remote log host

中等級 2自動化aix

說明

This recommendation implements a remote syslog configuration. To further enhance the local syslog logging process CIS recommends that syslog information, in particular that generated by the auth facility, is logged remotely. This recommendation assumes that a remote and secure syslog server is available on the network. Audit: automated read-only check derived from the CIS audit procedure; it prints "compliant" when the control is met.

檢查方式

稽核方法: Shell 指令

shell

[ -r /etc/syslog.conf ] || exit 1; n=$(grep -v "^[[:blank:]]*#" /etc/syslog.conf | grep -c "@"); [ "$n" -gt 0 ] && echo compliant || echo "no remote log host"

預期輸出: compliant

修補方式

修補方法: 操作指南或基礎設施修補檔

Explicitly define a remote host for auth.info data in /etc/syslog.conf (enter the remote host IP address in the example below): printf "auth.info\t\t@<IP address of remote syslog server>" >> /etc/syslog.conf NOTE: This ensures that remote login, sudo or su attempts are logged separately Create a remote host entry in /etc/syslog.conf to capture all other output of level info or higher (enter the remote host IP address in the example below): printf "*.info;auth.none\t@<IP address of remote syslog server>\n" >> /etc/syslog.conf Refresh syslogd to force the daemon to read the edited /etc/syslog.conf: refresh -s syslogd

屬性

作業系統: 不限
標籤: aixaudit
參考資料: CIS IBM AIX 7 Benchmark v1.2.0 - 8.2.2 Ensure syslog is configured to send logs to a remote log host

檢查此主機

請在您有權稽核的機器上執行此指令。掃描為唯讀操作。

shell

tmaegis scan --target aix --level 2