CCE-55021-0| Platform: cpe:/o:redhat:enterprise_linux:8,cpe:/o:oracle:linux:7,cpe:/o:oracle:linux:8,cpe:/o:amazon:linux:2,cpe:/o:redhat:enterprise_linux:9,cpe:/o:redhat:enterprise_linux:7,cpe:/o:centos:centos:7 | Date: (C)2024-01-08 (M)2024-04-23 |
Title:
Ensure systemd-journal-remote is installed
Description:
Journald (via systemd-journal-remote ) supports the ability to send log events it gathers to
a remote log host or to receive messages from remote hosts, thus enabling centralized log
management.
Rationale:
Storing log data on a remote host protects log integrity from local attacks. If an attacker
gains root access on the local system, they could tamper with or remove log data that is
stored on the local system.
Audit:
Verify systemd-journal-remote is installed.
Run the following command:
# rpm -q systemd-journal-remote
Verify the output matches:
# systemd-journal-remote-<version>
Remediation:
Run the following command to install systemd-journal-remote :
# dnf install systemd-journal-remote
Parameter:
[yes/no]
Technical Mechanism:
Remediation:
Run the following command to install systemd-journal-remote :
# dnf install systemd-journal-remote
| CCSS Severity: | CCSS Metrics: |
| CCSS Score : 6.0 | Attack Vector: LOCAL |
| Exploit Score: 0.8 | Attack Complexity: LOW |
| Impact Score: 5.2 | Privileges Required: HIGH |
| Severity: MEDIUM | User Interaction: NONE |
| Vector: AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:H | Scope: UNCHANGED |
| | Confidentiality: NONE |
| | Integrity: HIGH |
| | Availability: HIGH |
| | |
References: | Resource Id | Reference |
|---|
| SCAP Repo OVAL Definition | oval:org.secpod.oval:def:97191 |
| SCAP Repo OVAL Definition | oval:org.secpod.oval:def:96266 |
| SCAP Repo OVAL Definition | oval:org.secpod.oval:def:97222 |
| SCAP Repo OVAL Definition | oval:org.secpod.oval:def:97487 |
| SCAP Repo OVAL Definition | oval:org.secpod.oval:def:97454 |
| SCAP Repo OVAL Definition | oval:org.secpod.oval:def:97253 |
| SCAP Repo OVAL Definition | oval:org.secpod.oval:def:97514 |
