mediumloggingverified ✓rollback-safe

Monitor all remote access methods via rsyslog

rsyslog-remote-access-monitored · RHEL ≥ 8, UBUNTU ≥ 22 · 2 impls

Description

RHEL 8 must log all remote access methods. rsyslog must record the auth, authpriv, and daemon facilities (for example to /var/log/secure) so that remote login activity is captured.

Rationale

Logging remote access methods provides the audit trail needed to detect and investigate unauthorized access attempts. Missing any of the auth, authpriv, or daemon facilities leaves a gap in remote-access monitoring.

Check → Remediate

Checkcommand

conf=$(grep -rhE '^[[:space:]]*[^#]' /etc/rsyslog.conf /etc/rsyslog.d/*.conf 2>/dev/null)
printf '%s\n' "$conf" | grep -qE '(^|;|[[:space:]])auth\.\*' || exit 1
printf '%s\n' "$conf" | grep -qE '(^|;|[[:space:]])authpriv\.\*' || exit 1
printf '%s\n' "$conf" | grep -qE '(^|;|[[:space:]])daemon\.\*' || exit 1
exit 0

expected_exit:: 0

Remediateconfig_set_dropin

dir:: /etc/rsyslog.d
file:: 00-kensa-remote-access.conf
key:: auth.*;authpriv.*;daemon.*
value:: /var/log/secure
restart:: rsyslog
separator:

Framework references

STIG

V-280990 / RHEL-10-200647V-258144 / RHEL-09-652030V-230228 / RHEL-08-010070V-270681 / UBTU-24-200090V-260589 / UBTU-22-652015

NIST 800-53

AC-17(1)

Live verification

rhel8:checkubuntu22:checkubuntu24:check

#rsyslog#remote-access#logging#monitoring