Title

The system must only use remote syslog servers (log hosts) justified and documented using site-defined procedures. (Cat II impact)

Discussion

If a remote log host is in use and it has not been justified and documented with the IAO, sensitive information could be obtained by unauthorized users without the SA's knowledge. A remote log host is any host to which the system is sending syslog messages over a network.

Check Content

Examine the syslog.conf file for any references to remote log hosts. # grep -v "^#" /etc/syslog.conf | grep '@' Destination locations beginning with an @ represent log hosts. If the log host name is a local alias, such as log host, consult the /etc/hosts or other name databases as necessary to obtain the canonical name or address for the log host. Determine if the host referenced is a log host documented using site-defined procedures. If an undocumented log host is referenced, this is a finding.

Fix Text

Remove, replace, or document the referenced undocumented log host.

Additional Identifiers

Rule ID: SV-4395r2_rule

Vulnerability ID: V-4395

Group Title: GEN005460

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.