ComplianceAsCode / ComplianceAsCode/content
[BUG] RHEL-related automation should not inject log-collector hostname into /etc/rsyslog.conf
- Dominant language
- Shell
- Stars
- 2.8k
- Forks
- 828
- Avg merge
- 3d 8m
- Merged PRs (30d)
- 80
Description
#### Share the context
We use this project's content across several customers' projects. Initially discovered the problem last year, but reporting the issue "fell off the stack". Recently, began receiving complaints from another customer that they were seeing "host not found" entries in their system logs for the `logcollector` host specified in the post-hardening `/etc/rsyslog.conf` configuration.
#### Description of problem:
Looks like this project's remediation-automation is injecting `@@logcollector` into the hardened-systems' /etc/rsyslog.conf` configuration. At bare minimum, this results in nuisance "host not found" error-types. Also poses a potential security-risk: if someone injects `logcollector` into the DNS domain the hardened system is configured into, log-offload attempts could be made to a bogus/unsanctioned rsyslog. Security-concern aside, if someone injects `logcollector` into the DNS domain the hardened system is configured into, but doesn't stand up a collector, the "host not found" errors will be replaced with "cannot connect" error-types
#### Proposed change:
Centralize log-collection is inherently site-specific. In many cases, other services (e.g., Splunk, CloudWatch Agent, etc.) are used for offload rather than syslog. As such, the automation should include no remediative-actions that include injecting a logging-destination into the hardened-hosts' `/etc/rsyslog.conf` configurations.
CC: @lorengordon and @eemperor
Contributor guide
Assessment
This issue has not been assessed yet.