cirsec Baselines
Esc
Debian GNU/Linux · Logging & auditing

Send audit records to a remote server

When it fails: Audit records are only stored on the audited system. Someone who gains root on the system can erase or alter the audit log, the only copy of the evidence.

CB-DEB-AUDIT-015mediumactiveautomatedprofile server-hardened

Description

The au-remote plugin of audispd-plugins sends each audit record to a remote auditd that listens for them (tcp_listen_port on the server). It is turned on with active = yes in /etc/audit/plugins.d/au-remote.conf, and the server is set with remote_server in /etc/audit/audisp-remote.conf.

The fix is manual: the server address, port and transport (Kerberos or plain TCP inside a protected network) depend on the site. Forwarding audit records through rsyslog with TLS (syslog plugin and CB-DEB-AUDIT-009) is an accepted alternative; record it as an exception in the tailoring file.

Rationale

A copy kept off the system cannot be erased by an intruder who has taken root, and lets audit records from many systems be reviewed in one place.

Impact

Requires an audit collection server and a network flow to it (TCP 60 by default). Configure network_failure_action and the queue in audisp-remote.conf so an outage does not block the system.

Setting

Location/etc/audit/plugins.d/au-remote.conf, /etc/audit/audisp-remote.conf
Defaultactive = no, remote_server empty
Recommendedactive = yes, remote_server set to the audit collection server

Audit

  1. Run grep -E '^\s*active' /etc/audit/plugins.d/au-remote.conf. It must print active = yes.
  2. Run grep -E '^\s*remote_server' /etc/audit/audisp-remote.conf. It must name the server.
  3. On the server, check that records from this system arrive.

Automated: every check must pass. Scanners report each check by its id.

plugin-active

The au-remote plugin is active.

engine: File content
path: /etc/audit/plugins.d/au-remote.conf
pattern: ^\s*active\s*=\s*yes\s*$

remote-server

A remote server is set.

engine: File content
path: /etc/audit/audisp-remote.conf
pattern: ^\s*remote_server\s*=\s*\S+

Remediation

  1. Set remote_server = <server> (and port, transport) in /etc/audit/audisp-remote.conf.
  2. Set active = yes in /etc/audit/plugins.d/au-remote.conf.
  3. Run systemctl restart auditd, then check on the server that records arrive.

Rollback

Set active = no in /etc/audit/plugins.d/au-remote.conf and restart auditd.

References

Mappings

FrameworkIDRelation
ANSSI-BP-028 - Recommandations de configuration d'un système GNU/Linux2.0R73related
NIST SP 800-53 Rev. 55.1.1AU-4(1)equivalent
NIST SP 800-53 Rev. 55.1.1AU-9(2)related

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

TaxonomyID
MITRE ATT&CKT1070.002
MITRE ATT&CKT1562.012

People and lifecycle

Authors
Verified2026-10-18 by Sn0wAlice on 12, Proxmox VM, Debian 12 genericcloud image, kernel 6.1.0-54-cloud-amd64, BIOS boot. Fails after auditd install (plugin inactive); passes once active = yes and remote_server are set by hand.
Verified2026-10-18 by Sn0wAlice on 13, Proxmox VM, Debian 13 genericcloud image, kernel 6.12.113+deb13-cloud-amd64, BIOS boot. Fails after auditd install (plugin inactive); passes once active = yes and remote_server are set by hand.
Introduced inv0.1.0
Created, updated2026-10-18, 2026-10-18
Translationsfr