mediumloggingverified ✓
Ensure rsyslog does not receive logs from remote clients
rsyslog-no-remote-receive · RHEL ≥ 8 · 1 impl
Description
Unless acting as a log aggregation server, rsyslog must not be configured to receive log messages from remote clients.
Rationale
Receiving remote logs without proper authorization could allow attackers to flood logs or inject false log entries.
Check → Remediate
Checkcommand
grep -r "ModLoad imtcp\|InputTCPServerRun\|module(load=.imtcp.)\|input(type=.imtcp.)" /etc/rsyslog.conf /etc/rsyslog.d/*.conf 2>/dev/null | wc -l | grep -q "^0$"
- expected_exit:
- 0
Remediatemanual
- note:
- Remove imtcp module loading and TCP input configuration from /etc/rsyslog.conf and /etc/rsyslog.d/
Framework references
CIS
rhel8 6.2.2.7rhel9 6.2.3.7rhel10 6.2.3.7
STIG
V-280986 / RHEL-10-200643V-258143 / RHEL-09-652025
NIST 800-53
CM-7AU-9
Live verification
rhel10:checkrhel8:checkrhel9:check
#logging#rsyslog#remote