STIGQter: STIG Summary: Amazon Linux 2023 Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 01 Jul 2026:

Amazon Linux 2023 must encrypt, via the OpenSSL TLS (ossl) driver, the transfer of audit records off-loaded onto a different system or media from the system being audited by rsyslog.

DISA Rule

SV-274079r1210985_rule

Vulnerability Number

V-274079

Group Title

SRG-OS-000479-GPOS-00224

Rule Version

AZLX-23-002075

Severity

CAT II

CCI(s)

• CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.

Weight

10

Fix Recommendation

Configure Amazon Linux 2023 to use the OpenSSL TLS driver (ossl) to encrypt offloaded audit records by setting the following options in "/etc/rsyslog.conf" or "/etc/rsyslog.d/[customfile].conf":

$DefaultNetstreamDriver ossl

Check Contents

Verify Amazon Linux 2023 explicitly defines the OpenSSL TLS driver (ossl) for encrypted rsyslog offloading.

Search for an explicitly defined stream driver with the following command:
$ sudo grep -rE 'StreamDriver\s*=\s*"ossl"|\$DefaultNetstreamDriver\s+ossl' /etc/rsyslog.conf /etc/rsyslog.d/
/etc/rsyslog.conf:$DefaultNetstreamDriver ossl

If the value of the "$DefaultNetstreamDriver" option is not set to "ossl" or the line is commented out, this is a finding.

Vulnerability Number

V-274079

Documentable

False

Rule Version

AZLX-23-002075

Severity Override Guidance

Verify Amazon Linux 2023 explicitly defines the OpenSSL TLS driver (ossl) for encrypted rsyslog offloading.

Search for an explicitly defined stream driver with the following command:
$ sudo grep -rE 'StreamDriver\s*=\s*"ossl"|\$DefaultNetstreamDriver\s+ossl' /etc/rsyslog.conf /etc/rsyslog.d/
/etc/rsyslog.conf:$DefaultNetstreamDriver ossl

If the value of the "$DefaultNetstreamDriver" option is not set to "ossl" or the line is commented out, this is a finding.

Check Content Reference

M

Target Key

5700