UBUNTU24-CIS-Audit/section_6/cis_6.1.2.x/cis_6.1.2.1.4.yml

91 lines
2.0 KiB
YAML
Raw Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

---
{{ if .Vars.ubtu24cis_level_1 }}
{{ if .Vars.ubtu24cis_rule_6_1_2_1_4 }}
{{ if not .Vars.ubtu24cis_is_syslog_server }}
service:
systemd-journal-remote.service:
title: 6.1.2.1.4 | Ensure systemd-journal-remote service is not in use | service
running: false
# enabled: false # managed by socket so seen as indirect although not enabled - goss issue
meta:
server: 1
workstation: 1
CIS_ID:
- 6.1.2.1.4
CISv8:
- 4.8
- 8.2
CISv8_IG1: true
CISv8_IG2: true
CISv8_IG3: true
NIST800-53R5:
- AU-2
- AU-7
- AU-12
systemd-journal-remote.socket:
title: 6.1.2.1.4 | Ensure systemd-journal-remote service is not in use | socket
running: false
enabled: false
meta:
server: 1
workstation: 1
CIS_ID:
- 6.1.2.1.4
CISv8:
- 4.8
- 8.2
CISv8_IG1: true
CISv8_IG2: true
CISv8_IG3: true
NIST800-53R5:
- AU-2
- AU-7
- AU-12
command:
journald_service_masked:
title: 6.1.2.1.4 | Ensure systemd-journal-remote service is not in use | service masked
exec: systemctl is-enabled systemd-journal-remote.socket
exit-status: 1
stdout:
- '/^masked/'
meta:
server: 1
workstation: 1
CIS_ID:
- 6.1.2.1.4
CISv8:
- 4.8
- 8.2
CISv8_IG1: true
CISv8_IG2: true
CISv8_IG3: true
NIST800-53R5:
- AU-2
- AU-7
- AU-12
journald_socket_masked:
title: 6.1.2.1.4 | Ensure systemd-journal-remote service is not in use | socket masked
exec: systemctl is-enabled systemd-journal-remote.socket
exit-status: 1
stdout:
- '/^masked/'
meta:
server: 1
workstation: 1
CIS_ID:
- 6.1.2.1.4
CISv8:
- 4.8
- 8.2
CISv8_IG1: true
CISv8_IG2: true
CISv8_IG3: true
NIST800-53R5:
- AU-2
- AU-7
- AU-12
{{ end }}
{{ end }}
{{ end }}