Authenticate rsyslog remote logging server with x509 certificate

# Accept either rsyslog dialect setting authmode to x509/name:
#   legacy global directive $ActionSendStreamDriverAuthMode x509/name, or
#   modern omfwd action-object streamdriver.authmode/tls.authmode="x509/name".
# has() drops full-line comments so a commented example is not a false PASS
# (XCCDF: a commented-out authmode line is a finding). The modern
# module-block-vs-omfwd-block placement nuance remains a manual check.
has() { grep -rhsE "$1" /etc/rsyslog.conf /etc/rsyslog.d/ 2>/dev/null | grep -qv '^[[:space:]]*#'; }
if has '^[[:space:]]*\$ActionSendStreamDriverAuthMode[[:space:]]+x509/name' \
   || has '(streamdriver\.authmode|tls\.authmode)[[:space:]]*=[[:space:]]*"?x509/name"?'; then
  echo "OK: rsyslog authenticates the remote logging server (authmode x509/name)"
  exit 0
fi
echo "FAIL: rsyslog does not set authmode to x509/name (legacy or modern syntax)"
exit 1

expected_exit:

0

dir:

/etc/rsyslog.d

file:

00-kensa-stream-auth.conf

key:

$ActionSendStreamDriverAuthMode

value:

x509/name

restart:

rsyslog