[PATCH 1/5] Updated XCCDF and OVAL of groupowner_rsyslog_files

Jeffrey Blank blank at eclipse.ncsc.mil
Tue Apr 16 17:59:03 UTC 2013


> 
> How reliable would you like this to be?
> 
> rsyslog is capable of generating file names based on message content
> (e.g. embedding the sender IP in it). This cannot be parsed out of a
> configuration file. Fixed-name log files would be possible.

I think we'd be very happy to simply achieve that.

> rsyslog can also include config files recursively (through the
> $IncludeConfig directive) and I'm not sure OVAL can handle this.

It probably can't.  This entire thing is best-effort on any system where
configuration is controlled by a sea of files of arbitrary formats
splattered around a file system.  So, we'll just do what we can.

> You can get some results, but not perfect. The easiest way would be to
> include a list of log files provided by the rpm, which is the most
> typical scenario.

Well, it's probably a little more desirable/maintainable (hopefully) to
keep some OVAL that would try to see what the static log files are.

> I know a bit about rsyslog and OVAL if you have more questions.

Excellent.

In general, would you claim that an admin would have had to go out of
his way to get rsyslog to create a log file with lousy permissions?
I think so, but verification would be nice (so that we can say this
isn't something we really would worry about).

If you'd like to take a shot at creating the OVAL that could grab static
files specified by rsyslog.conf, that would be great.

Indeed, as an rsyslog expert, if there is any general advice which you
believe is incorrect or missing, comments/contributions are always welcome.


>> Relatedly, an automated check for ensuring that log files exist (Rule
>> id=rsyslog_logfiles_exist)  would be particularly nice, since IIRC the
>> behavior of syslog (possibly also rsyslog) is to not automatically
>> create new log files (if they are deleted at some point).
> 
> They are recreated, as Shawn has pointed out.

Yes -- excellent!
(No idea why ksyslogd ever behaved that way.)

Correction next...



More information about the scap-security-guide mailing list