sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

adding secure rsyslog exceptions

Browse Source
This commit is contained in:
Audiobuzz
2026-06-19 05:01:32 +00:00
parent 18b47ca5b0
commit 13ac648267
3 changed files with 36 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
files/stig/diskless-tailoring.xml
+12 -2
View File
@@ -72,13 +72,23 @@
<xccdf:select idref="xccdf_org.ssgproject.content_rule_package_firewalld_installed" selected="false"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_set_firewalld_default_zone" selected="false"/>
<!-- Remote audit offload: LOCAL-only for now (decision). auditd runs and logs
to the overlay; audisp-remote/rsyslog remote loghost waived. -->
<!-- Remote audit offload: done via rsyslog (provisioner 2f) to the lab
collector. The audisp-remote native-protocol rules stay waived. -->
<xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_configure_remote_server" selected="false"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_encrypt_sent_records" selected="false"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_network_failure_action" selected="false"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" selected="false"/>
<!-- rsyslog TLS offload: these force gtls + x509 peer auth + a CA file for ALL
forwarding. The lab boot LAN is isolated and plaintext (HTTP boot, no
MACsec); applying them makes rsyslog require TLS and BREAKS the plaintext
2f forward to serving/audit-collector (no CA, plaintext :514). Waived for
the lab; TLS offload is tracked as production hardening (docs/TODO.md #2).
Re-select once the collector has a cert + the CA is bundled in the image. -->
<xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_defaultnetstreamdriver" selected="false"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdrivermode" selected="false"/>
<xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdriverauthmode" selected="false"/>
<!-- Smart card: diskless, key-based admin; no PKI/smartcard reader. Enabling
smartcard-required login would lock the host out. -->
<xccdf:select idref="xccdf_org.ssgproject.content_rule_require_smart_card_login" selected="false"/>