STIGQter: STIG Summary: Tri-Lab Operating System Stack (TOSS) 5 Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 26 Mar 2026:

TOSS 5 must be configured so the rsyslog daemon does not accept log messages from other servers unless the server is being used for log aggregation.

DISA Rule

SV-282747r1201386_rule

Vulnerability Number

V-282747

Group Title

SRG-OS-000480-GPOS-00227

Rule Version

TOSS-05-000378

Severity

CAT II

CCI(s)

CCI-000366 - Implement the security configuration settings.

Weight

Fix Recommendation

Configure TOSS 5 to not receive remote logs using rsyslog.

Remove the lines in "/etc/rsyslog.conf" and any files in the "/etc/rsyslog.d" directory that match any of the following:

$ModLoad imtcp
$ModLoad imudp
$ModLoad imrelp
$InputTCPServerRun [0-9]*
$UDPServerRun [0-9]*
$InputRELPServerRun [0-9]*

Restart the rsyslog daemon for the changes to take effect.

$ sudo systemctl restart rsyslog.service

Check Contents

Verify TOSS 5 is not configured to receive remote logs using rsyslog with the following commands:

$ grep -i modload /etc/rsyslog.conf /etc/rsyslog.d/*
$ModLoad imtcp
$ModLoad imrelp

$ grep -i serverrun /etc/rsyslog.conf /etc/rsyslog.d/*
$InputTCPServerRun 514
$InputRELPServerRun 514

Note: An error about no files or directories may be returned. This is not a finding.

If any lines are returned by the command, then rsyslog is configured to receive remote messages, and this is a finding.

Vulnerability Number

V-282747

Documentable

False

Rule Version

TOSS-05-000378

Severity Override Guidance

Check Content Reference

Target Key

5738