ComplianceAsCode / ComplianceAsCode/content

[BUG] RHEL-related automation should not inject log-collector hostname into /etc/rsyslog.conf

Open
#11,812 5 comments 2 reactions 0 assignees View on GitHub
enhancement triaged
Dominant language
Shell
Stars
2.8k
Forks
828
Avg merge
3d 8m
Merged PRs (30d)
80

Description

#### Share the context

We use this project's content across several customers' projects. Initially discovered the problem last year, but reporting the issue "fell off the stack". Recently, began receiving complaints from another customer that they were seeing "host not found" entries in their system logs for the `logcollector` host specified in the post-hardening `/etc/rsyslog.conf` configuration.

#### Description of problem:

Looks like this project's remediation-automation is injecting `@@logcollector` into the hardened-systems' /etc/rsyslog.conf` configuration. At bare minimum, this results in nuisance "host not found" error-types. Also poses a potential security-risk: if someone injects `logcollector` into the DNS domain the hardened system is configured into, log-offload attempts could be made to a bogus/unsanctioned rsyslog. Security-concern aside, if someone injects `logcollector` into the DNS domain the hardened system is configured into, but doesn't stand up a collector, the "host not found" errors will be replaced with "cannot connect" error-types

#### Proposed change:

Centralize log-collection is inherently site-specific. In many cases, other services (e.g., Splunk, CloudWatch Agent, etc.) are used for offload rather than syslog. As such, the automation should include no remediative-actions that include injecting a logging-destination into the hardened-hosts' `/etc/rsyslog.conf` configurations.

CC: @lorengordon and @eemperor

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.