STIGQter: STIG Summary: Red Hat Enterprise Linux 10 Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 01 Jul 2026:

RHEL 10 must encrypt, via the gtls driver, the transfer of audit records off-loaded onto a different system or media from the system being audited via rsyslog.

DISA Rule

SV-280989r1197222_rule

Vulnerability Number

V-280989

Group Title

SRG-OS-000342-GPOS-00133

Rule Version

RHEL-10-200646

Severity

CAT II

CCI(s)

CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.

Weight

Fix Recommendation

Configure RHEL 10 to explicitly define a TLS driver for rsyslog to use for encrypting off-loaded audit records. The "ossl" driver is required for environments operating in FIPS mode.

Add the "streamdriver" parameter to the "omfwd" action rule in its configuration file (e.g., /etc/rsyslog.d/99-forwarding.conf).

Example:
action(
type="omfwd"
streamdriver="ossl"
target="logserver.example.com"
protocol="tcp"
port="6514"
tls="on"
)

After applying the configuration, restart the rsyslog service:
$ sudo systemctl restart rsyslog

Check Contents

Verify RHEL 10 explicitly defines a TLS driver (gtls or ossl) for encrypted rsyslog off-loading.

Search for an explicitly defined stream driver within "omfwd" action blocks with the following command:

$ sudo grep -rE 'StreamDriver\s*=\s*"(gtls|ossl)"' /etc/rsyslog.conf /etc/rsyslog.d/

If TLS-based "omfwd" forwarding is configured, but the command above returns no active configuration lines specifying either "gtls" or "ossl" within the action block, this is a finding.

Vulnerability Number

V-280989

Documentable

False

Rule Version

RHEL-10-200646

Severity Override Guidance

Check Content Reference

Target Key

5733