lowloggingverified ✓rollback-safe
Ensure systemd-journal-remote socket is disabled
journald-remote-disabled · RHEL ≥ 8 · 1 impl
Description
The systemd-journal-remote service should be disabled unless the system is specifically configured as a log collection server.
Rationale
Running a log collection service when not required increases the attack surface. Only systems designated as log aggregators should accept remote journal entries.
Check → Remediate
Checkservice_state
- name:
- systemd-journal-remote.socket
- enabled:
- false
Remediateservice_masked
- name:
- systemd-journal-remote.socket
- stop:
- true
Framework references
CIS
rhel8 6.2.1.2.4rhel9 6.2.2.1.4rhel10 6.2.2.1.4
NIST 800-53
CM-7
Live verification
rhel10:checkrhel8:checkrhel9:check
#journald#remote#logging#attack-surface