securing oracle linux 9 article 23 configuring logging rsyslog and journald

سیستم عامل و زیرساخت Hits: 11

In the previous part, Configuring System Integrity Check with AIDE was completed.

1. CIS Benchmark Requirements (Section 6.2)

  • 6.2.1 Configure systemd-journald service
  • 6.2.1.1 Ensure journald service is enabled and active (Automated)
  • 6.2.1.2 Ensure journald log file access is configured (Manual)
  • 6.2.1.3 Ensure journald log file rotation is configured (Manual)
  • 6.2.1.4 Ensure only one logging system is in use (Automated)
  • 6.2.2 Configure journald
  • 6.2.2.1 Configure systemd-journal-remote
  • 6.2.2.1.1 Ensure systemd-journal-remote is installed (Automated)
  • 6.2.2.1.2 Ensure systemd-journal-upload authentication is configured (Manual)
  • 6.2.2.1.3 Ensure systemd-journal-upload is enabled and active (Automated)
  • 6.2.2.1.4 Ensure systemd-journal-remote service is not in use (Automated)
  • 6.2.2.2 Ensure journald ForwardToSyslog is disabled (Automated)
  • 6.2.2.3 Ensure journald Compress is configured (Automated)
  • 6.2.2.4 Ensure journald Storage is configured (Automated)
  • 6.2.3 Configure rsyslog
  • 6.2.3.1 Ensure rsyslog is installed (Automated)
  • 6.2.3.2 Ensure rsyslog service is enabled and active (Automated)
  • 6.2.3.3 Ensure journald is configured to send logs to rsyslog (Automated)
  • 6.2.3.4 Ensure rsyslog log file creation mode is configured (Automated)
  • 6.2.3.5 Ensure rsyslog logging is configured (Manual)
  • 6.2.3.6 Ensure rsyslog is configured to send logs to a remote log host (Manual)
  • 6.2.3.7 Ensure rsyslog is not configured to receive logs from a remote client (Automated)
  • 6.2.3.8 Ensure rsyslog logrotate is configured (Manual)

2. Concept and Security Rationale

  • Initial log collection (journald): The systemd-journald service is responsible for collecting logs from the kernel and system services. Enabling compression (Compress) and persistent storage (Storage=persistent) is necessary to prevent logs from being lost after a system reboot.
  • Central processing and forwarding (rsyslog): In enterprise environments, logs should be forwarded to a central server or SIEM platform. If a local server is compromised, an attacker should not be able to remove local logs and eliminate evidence of their activity.
  • Preventing redundancy and information disclosure: Disabling ForwardToSyslog in journald is necessary because rsyslog can read logs directly from the journal socket. In addition, setting log file permissions to 0640 ensures that ordinary users cannot view sensitive information recorded in log files.

3. Oracle Database Compatibility (RAC and Grid)

Conflict level: Low; independent management is required.

Oracle requirements and considerations:

  • Database log management (ADR): Oracle Database and Grid Infrastructure services use their own independent structure called ADR, located under $ORACLE_BASE/diag. Operating-system tools such as logrotate must not be configured for Oracle alert.log or listener.log files. The lifecycle of these logs should be managed exclusively by the Oracle-specific adrci utility.
  • Audit log forwarding (OS Audit Logs): When the Oracle AUDIT_SYSLOG_LEVEL parameter is enabled, the database sends its audit records to the Linux logging system through syslog. In this case, the correct operation of rsyslog and its forwarding to a central SIEM platform are essential for compliance with organizational security standards and are compatible with Oracle architecture.

4. Auditing the Current Configuration

This script checks the status of logging services, compression settings, forwarding configuration, and log file permissions.

The path of this script in GitHub is: modules/audit_23_Logging_Rsyslog_Journald.sh

If you are not familiar with Bash scripting, you can refer to the training course published on the website for database administrators: Bash for Oracle DBAs 

#!/bin/bash
# Script: audit23.sh
# Purpose: Audit System Logging Configuration (CIS)

ISSUES=0

echo "=========================================================================="
echo " CIS Requirement: System Logging Configuration"
echo " - Ensure systemd-journald is configured properly (Compress, Storage, ForwardToSyslog)."
echo " - Ensure rsyslog is active, FileCreateMode is 0640, and Remote Logging is set."
echo " - Ensure log files have appropriate permissions (0640 or stricter)."
echo " Oracle Context & Exceptions:"
echo " - Permissions on Oracle pre-install logs and oracleasm will be secured"
echo "   without affecting functionality. Remote logging has NO DB/Grid conflict."
echo "=========================================================================="
echo ""

# 1. Checking systemd-journald settings
echo "[*] 1. Checking systemd-journald settings..."
if grep -Eq "^Compress=yes" /etc/systemd/journald.conf; then
    echo -e "  [\e[32mPASS\e[0m] Compress=yes is configured."
else
    echo -e "  [\e[31mFAIL\e[0m] Compress=yes is missing or commented out."
    ((ISSUES++))
fi

if grep -Eq "^Storage=persistent" /etc/systemd/journald.conf; then
    echo -e "  [\e[32mPASS\e[0m] Storage=persistent is configured."
else
    echo -e "  [\e[31mFAIL\e[0m] Storage=persistent is missing or commented out."
    ((ISSUES++))
fi

if grep -Eq "^ForwardToSyslog=yes" /etc/systemd/journald.conf; then
    echo -e "  [\e[32mPASS\e[0m] ForwardToSyslog=yes is configured."
else
    echo -e "  [\e[31mFAIL\e[0m] ForwardToSyslog=yes is missing or commented out."
    ((ISSUES++))
fi

# 2. Checking rsyslog status & FileCreateMode
echo -e "\n[*] 2. Checking rsyslog status & FileCreateMode..."
if systemctl is-active --quiet rsyslog; then
    echo -e "  [\e[32mPASS\e[0m] rsyslog is active."
else
    echo -e "  [\e[31mFAIL\e[0m] rsyslog is NOT active."
    ((ISSUES++))
fi

if grep -Eq '^\$FileCreateMode 0640' /etc/rsyslog.conf /etc/rsyslog.d/*.conf 2>/dev/null; then
    echo -e "  [\e[32mPASS\e[0m] rsyslog FileCreateMode is set to 0640."
else
    echo -e "  [\e[31mFAIL\e[0m] rsyslog FileCreateMode 0640 is missing."
    ((ISSUES++))
fi

# 3. Checking Remote Logging Configuration
echo -e "\n[*] 3. Checking Remote Logging Configuration..."
REMOTE_CONF=$(grep -E '^\*\.\* \@' /etc/rsyslog.conf /etc/rsyslog.d/*.conf 2>/dev/null)
if [ -n "$REMOTE_CONF" ]; then
    echo -e "  [\e[32mPASS\e[0m] Remote logging is configured."
else
    echo -e "  [\e[31mFAIL\e[0m] Remote logging is NOT configured. Logs are only stored locally."
    ((ISSUES++))
fi

# 4. Checking Logfile Permissions
echo -e "\n[*] 4. Checking Logfile Permissions..."
BAD_PERMS=$(find /var/log -type f -perm /0137 ! -name 'lastlog' ! -name 'wtmp' ! -name 'btmp' 2>/dev/null)
if [ -z "$BAD_PERMS" ]; then
    echo -e "  [\e[32mPASS\e[0m] General log file permissions are secure."
else
    echo -e "  [\e[31mFAIL\e[0m] Some log files have insecure permissions."
    ((ISSUES++))
fi

echo -e "\n=========================================================================="
if [ $ISSUES -eq 0 ]; then
    echo -e " [-] AUDIT RESULT: \e[32mPASS\e[0m (0 issues found)"
else
    echo -e " [-] AUDIT RESULT: \e[31mFAIL\e[0m ($ISSUES issues found)"
fi
echo "=========================================================================="

5. Applying the Configuration (Remediation Bash Script)

This script installs the required packages, applies journald and rsyslog settings, and corrects permissions on existing log files.

The path of this script in GitHub is: modules/remediate_23_Logging_Rsyslog_Journald.sh 

#!/bin/bash
# Script: remediation23.sh
# Purpose: Configure System Logging (CIS 6.2) for Oracle Linux environments

echo "=========================================================================="
echo " Applying Remediation: System Logging Configuration"
echo "=========================================================================="

# 1. systemd-journald configuration
echo "[+] Configuring systemd-journald..."
sed -i 's/^#Compress=.*/Compress=yes/' /etc/systemd/journald.conf
sed -i 's/^#Storage=.*/Storage=persistent/' /etc/systemd/journald.conf
sed -i 's/^#ForwardToSyslog=.*/ForwardToSyslog=yes/' /etc/systemd/journald.conf

# Ensure entries exist if they were entirely missing
grep -q "^Compress=yes" /etc/systemd/journald.conf || echo "Compress=yes" >> /etc/systemd/journald.conf
grep -q "^Storage=persistent" /etc/systemd/journald.conf || echo "Storage=persistent" >> /etc/systemd/journald.conf
grep -q "^ForwardToSyslog=yes" /etc/systemd/journald.conf || echo "ForwardToSyslog=yes" >> /etc/systemd/journald.conf

systemctl restart systemd-journald

# 2. rsyslog configuration (FileCreateMode)
echo "[+] Configuring rsyslog FileCreateMode..."
if grep -q "^\$FileCreateMode" /etc/rsyslog.conf; then
    sed -i 's/^\$FileCreateMode.*/$FileCreateMode 0640/' /etc/rsyslog.conf
else
    # Add it to the configuration if missing
    echo "\$FileCreateMode 0640" >> /etc/rsyslog.conf
fi

# 3. Remote Logging Configuration
echo "[+] Configuring Remote Logging..."
# Prompt user for log server
read -p "Enter Remote Syslog Server IP/Hostname (Press Enter to skip if none): " REMOTE_SERVER

if [ -n "$REMOTE_SERVER" ]; then
    # Remove old forwarding rules if they exist
    sed -i '/^\*\.\* @@/d' /etc/rsyslog.conf
    sed -i '/^\*\.\* @/d' /etc/rsyslog.conf

    # Add new TCP forwarding rule at the end of the file
    echo "*.* @@${REMOTE_SERVER}:514" >> /etc/rsyslog.conf
    echo "  -> Remote logging configured to send to ${REMOTE_SERVER} via TCP."
else
    echo "  -> No Remote Syslog Server provided. Skipping remote configuration."
fi

# Ensure rsyslog is enabled and restart to apply changes
systemctl enable --quiet rsyslog
systemctl restart rsyslog

# 4. Fixing Log Permissions
echo "[+] Securing existing log file permissions..."
find /var/log -type f -exec chmod g-wx,o-rwx "{}" +
# Restore specific permissions for special log files (like wtmp, btmp, lastlog)
[ -f /var/log/wtmp ] && chmod 0664 /var/log/wtmp
[ -f /var/log/lastlog ] && chmod 0664 /var/log/lastlog
[ -f /var/log/btmp ] && chmod 0660 /var/log/btmp

echo "=========================================================================="
echo " Remediation completed successfully."
echo " Run ./audit23.sh again to verify."
echo "=========================================================================="

In the next part, we will cover Managing Log File Access .