Skip to content

Add service_systemd-journal-upload_enabled to RHEL 10 CIS #14069

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Nov 4, 2025
+24 −7
Merged

Add service_systemd-journal-upload_enabled to RHEL 10 CIS #14069

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
de49a89
Add service_systemd-journal-upload_enabled to RHEL 10 CIS
jan-cerny Oct 30, 2025
704f1ea
Improve description and rationale
jan-cerny Oct 31, 2025
819c918
Add a warning
jan-cerny Nov 3, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 3 additions & 2 deletions controls/cis_rhel10.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2428,8 +2428,9 @@ controls:
levels:
- l1_server
- l1_workstation
status: pending
notes: New templated rule is necessary.
status: automated
rules:
- service_systemd-journal-upload_enabled

- id: 6.2.2.1.4
title: Ensure systemd-journal-remote service is not in use (Automated)
Expand Down
21 changes: 17 additions & 4 deletions linux_os/guide/system/logging/journald/service_systemd-journal-upload_enabled/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,17 +3,25 @@ documentation_complete: true
title: 'Enable systemd-journal-upload Service'

description: |-
{{{ full_name }}} must offload rsyslog messages for networked systems in real time and
offload standalone systems at least weekly.
The <tt>systemd-journal-upload</tt> service is part of the <tt>systemd-journal-remote</tt> package
and enables centralized logging by uploading local systemd journal entries to a remote log
server via HTTPS. This service acts as a client that pushes journal data to a remote host
running the <tt>systemd-journal-remote</tt> receiver service.
{{{ describe_service_enable(service="systemd-journal-upload") }}}

rationale: |-
{{{ full_name }}} must offload rsyslog messages for networked systems in real time and
offload standalone systems at least weekly.
Centralized logging through <tt>systemd-journal-upload</tt> is essential for security monitoring,
incident response, and compliance requirements. Storing log data on a remote host protects log
integrity from local attacks. If an attacker gains root access on the local system, they could
tamper with or remove log data stored locally to hide their activities. Remote logging ensures
that audit trails remain intact even if the local system is compromised. Additionally,
centralized logs facilitate correlation of events across multiple systems, enabling better
detection of distributed attacks and security incidents.

severity: medium

identifiers:
cce@rhel10: CCE-86711-9
cce@sle15: CCE-92604-8
cce@slmicro5: CCE-94084-1
cce@slmicro6: CCE-94735-8
Expand All @@ -38,3 +46,8 @@ template:
vars:
servicename: systemd-journal-upload
packagename: systemd-journal-remote

warnings:
- general: |-
The <tt>systemd-journal-upload</tt> service will fail to start if the remote server URL is not configured.
Edit <tt>/etc/systemd/journal-upload.conf</tt> to configure the remote server URL.
1 change: 0 additions & 1 deletion shared/references/cce-redhat-avail.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,7 +76,6 @@ CCE-86707-7
CCE-86708-5
CCE-86709-3
CCE-86710-1
CCE-86711-9
CCE-86712-7
CCE-86713-5
CCE-86726-7
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel10/cis.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -335,6 +335,7 @@ service_cups_disabled
service_firewalld_enabled
service_nfs_disabled
service_rpcbind_disabled
service_systemd-journal-upload_enabled
service_systemd-journald_enabled
set_password_hashing_algorithm_libuserconf
set_password_hashing_algorithm_logindefs
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel10/cis_server_l1.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -239,6 +239,7 @@ service_cups_disabled
service_firewalld_enabled
service_nfs_disabled
service_rpcbind_disabled
service_systemd-journal-upload_enabled
service_systemd-journald_enabled
set_password_hashing_algorithm_libuserconf
set_password_hashing_algorithm_logindefs
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel10/cis_workstation_l1.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -230,6 +230,7 @@ service_crond_enabled
service_firewalld_enabled
service_nfs_disabled
service_rpcbind_disabled
service_systemd-journal-upload_enabled
service_systemd-journald_enabled
set_password_hashing_algorithm_libuserconf
set_password_hashing_algorithm_logindefs
Expand Down
1 change: 1 addition & 0 deletions tests/data/profile_stability/rhel10/cis_workstation_l2.profile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -332,6 +332,7 @@ service_crond_enabled
service_firewalld_enabled
service_nfs_disabled
service_rpcbind_disabled
service_systemd-journal-upload_enabled
service_systemd-journald_enabled
set_password_hashing_algorithm_libuserconf
set_password_hashing_algorithm_logindefs
Expand Down
Loading