← Back to SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

V-4395

CAT II (Medium)

The system must only use remote syslog servers (log hosts) that is justified and documented using site-defined procedures.

Rule ID

SV-45989r1_rule

STIG

SUSE Linux Enterprise Server v11 for System z Security Technical Implementation Guide

Version

V1R12

CCIs

CCI-000366

Discussion

If a remote log host is in use and it has not been justified and documented with the IAO, sensitive information could be obtained by unauthorized users without the SA's knowledge. A remote log host is any host to which the system is sending syslog messages over a network.

Check Content

Examine the rsyslog.conf file for any references to remote log hosts.
# grep -v "^#" /etc/rsyslog* | grep '@'
# grep -v "^#" /etc/rsyslog.d/* | grep '@'
Destination locations beginning with an '@' represent log hosts. If the log host name is a local alias such as "loghost", consult the /etc/hosts or other name databases as necessary to obtain the canonical name or address for the log host. Determine if the host referenced is a log host documented using site-defined procedures. If an undocumented log host is referenced, this is a finding.

Fix Text

Remove or document the referenced undocumented log host.