STIGQter STIGQter: STIG Summary: Red Hat Enterprise Linux 8 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 23 Apr 2021:

The RHEL 8 audit records must be off-loaded onto a different system or storage media from the system being audited.

DISA Rule

SV-230479r627750_rule

Vulnerability Number

V-230479

Group Title

SRG-OS-000342-GPOS-00133

Rule Version

RHEL-08-030690

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the operating system to off-load audit records onto a different system or media from the system being audited by specifying the remote logging server in "/etc/rsyslog.conf" or "/etc/rsyslog.d/[customfile].conf" with the name or IP address of the log aggregation server.

*.* @@[remoteloggingserver]:[port]

Check Contents

Verify the audit system off-loads audit records onto a different system or media from the system being audited with the following command:

$ sudo grep @@ /etc/rsyslog.conf /etc/rsyslog.d/*.conf

/etc/rsyslog.conf:*.* @@[remoteloggingserver]:[port]

If a remote server is not configured, or the line is commented out, ask the System Administrator to indicate how the audit logs are off-loaded to a different system or media.

If there is no evidence that the audit logs are being off-loaded to another system or media, this is a finding.

Vulnerability Number

V-230479

Documentable

False

Rule Version

RHEL-08-030690

Severity Override Guidance

Verify the audit system off-loads audit records onto a different system or media from the system being audited with the following command:

$ sudo grep @@ /etc/rsyslog.conf /etc/rsyslog.d/*.conf

/etc/rsyslog.conf:*.* @@[remoteloggingserver]:[port]

If a remote server is not configured, or the line is commented out, ask the System Administrator to indicate how the audit logs are off-loaded to a different system or media.

If there is no evidence that the audit logs are being off-loaded to another system or media, this is a finding.

Check Content Reference

M

Target Key

2921

Comments