Adding rsyslog tls

files/stig/diskless-tailoring.xml

@@ -79,15 +79,13 @@
     <xccdf:select idref="xccdf_org.ssgproject.content_rule_auditd_audispd_network_failure_action" selected="false"/>
     <xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_remote_loghost" selected="false"/>
 
-    <!-- rsyslog TLS offload: these force gtls + x509 peer auth + a CA file for ALL
-         forwarding. The lab boot LAN is isolated and plaintext (HTTP boot, no
-         MACsec); applying them makes rsyslog require TLS and BREAKS the plaintext
-         2f forward to serving/audit-collector (no CA, plaintext :514). Waived for
-         the lab; TLS offload is tracked as production hardening (docs/TODO.md #2).
-         Re-select once the collector has a cert + the CA is bundled in the image. -->
-    <xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_defaultnetstreamdriver" selected="false"/>
-    <xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdrivermode" selected="false"/>
-    <xccdf:select idref="xccdf_org.ssgproject.content_rule_rsyslog_encrypt_offload_actionsendstreamdriverauthmode" selected="false"/>
+    <!-- rsyslog TLS offload (rsyslog_encrypt_offload_*): SELECTED/enforced since
+         2026-07-12 — the 2f forward is now syslog-over-TLS (gtls :6514, x509/name
+         vs the baked fleet CA /etc/dot1x/radius-ca.pem) to serving/audit-collector.
+         rsyslog+rsyslog-gnutls are installed in step 2 (before this scan) so the
+         rules are applicable; remediation writes the legacy gtls/x509 globals and
+         the eval of record passes. Do NOT re-waive: a plaintext forward is a real
+         finding now (docs/stig-deviations.md #6). -->
 
     <!-- Smart card: diskless, key-based admin; no PKI/smartcard reader. Enabling
          smartcard-required login would lock the host out. -->