sunjizzle/diskless-workstation
1
0
Fork 0
Code Issues Pull Requests Actions 1 Packages Projects Releases Wiki Activity

Add audit log sending

Browse Source
This commit is contained in:
Audiobuzz
2026-06-19 00:20:34 +00:00
parent 5e2bfef575
commit bc8247b410
3 changed files with 42 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/TODO.md
+6 -4
View File
@@ -107,10 +107,12 @@ keeps full STIG. Justified as register deviation #10. **Bench-verify on rebuild:
kiosk renders + admin SSH works with hardening on.**
Remaining (future hardening, currently waived — see the register): FIPS,
firewall, per-host/rotatable admin access. **Remote audit offload — receiver
DONE** (`serving/audit-collector/`, rsyslog over TCP/514, per-source-host files;
DNS name `${AUDIT_HOST}`); the **image-side sender** (audisp-syslog + rsyslog
forward to `audit.fleet.lab`) is still to wire — see that dir's README.
firewall, per-host/rotatable admin access. **Remote audit offload — WIRED both
ends** (2026-06-19): receiver `serving/audit-collector/` (rsyslog TCP/514,
per-source-host files) + sender in the image (provisioner 2f, `audit_host` var:
audisp-syslog→LOCAL6 + rsyslog `omfwd` to `audit.fleet.lab`). Lab is plaintext;
TLS/RELP is the remaining hardening. **Bench-verify:** booted host's auditd AVCs
land in `audit-collector/logs/<ip>/audit.log` and journal in `messages.log`.
### Original spec (retained for reference)