Encrypt and authenticate the rsyslog connection to the log server

Description

rsyslog encrypts its forwarding with the GnuTLS network stream driver from the rsyslog-gnutls package. This control requires:

• the rsyslog-gnutls package;
• a forwarding action (omfwd or the legacy @@host) using the gtls driver in TLS-only mode (StreamDriverMode="1");
• the CA certificate that signs the log server certificate (DefaultNetstreamDriverCAFile or StreamDriver.CAFile), and server authentication by certificate name (StreamDriverAuthMode="x509/name").

Rationale

Logs carry user names, addresses and sometimes secrets. TLS keeps them confidential and intact in transit, and certificate checks stop an attacker from posing as the log server.

Impact

Requires a log server that accepts TLS (port 6514 by convention) and a certificate chain to distribute. A wrong CA or name makes rsyslog queue messages instead of sending them.

Applies when

Detected: when: rsyslog is installed A scanner reports the control not applicable when one is false.

Only when rsyslog is the logging system. With the journal alone, systemd-journal-upload always uses HTTPS (CB-DEB-AUDIT-008).

Setting

Audit

1. Run dpkg-query -W -f='${Status}\n' rsyslog-gnutls. It must end with installed.
2. In /etc/rsyslog.conf and /etc/rsyslog.d/*.conf, find the forwarding action. It must use StreamDriver="gtls" (or $DefaultNetstreamDriver gtls), StreamDriverMode="1" and StreamDriverAuthMode="x509/name".
3. DefaultNetstreamDriverCAFile (or StreamDriver.CAFile) must name an existing CA file.

Automated: every check must pass. Scanners report each check by its id.

gnutls

rsyslog-gnutls is installed.

name: rsyslog-gnutls
state: installed

forward-tls

A forwarding action that uses the gtls driver in TLS-only mode.

script: |
  c=$(cat /etc/rsyslog.conf /etc/rsyslog.d/*.conf 2>/dev/null | grep -Ev '^[[:space:]]*(#|$)')
  if ! printf '%s\n' "$c" | grep -Eiq 'type="?omfwd|[[:space:]]@@?[^[:space:]]'; then
    echo "no forwarding action"
    exit 1
  fi
  d=no m=no
  printf '%s\n' "$c" | grep -Eiq 'StreamDriver(Name)?[[:space:]]*=[[:space:]]*"?gtls|DefaultNetstreamDriver[[:space:]]*=?[[:space:]]*"?gtls' && d=yes
  printf '%s\n' "$c" | grep -Eiq 'StreamDriverMode[[:space:]]*=?[[:space:]]*"?1' && m=yes
  echo "forwarding found, gtls driver: $d, TLS-only mode: $m"
  [ "$d" = yes ] && [ "$m" = yes ]

ca-auth

CA file configured and server authenticated by certificate name.

script: |
  c=$(cat /etc/rsyslog.conf /etc/rsyslog.d/*.conf 2>/dev/null | grep -Ev '^[[:space:]]*(#|$)')
  ca=$(printf '%s\n' "$c" | sed -n 's/.*\(DefaultNetstreamDriverCAFile\|StreamDriver\.CAFile\)[[:space:]]*=\{0,1\}[[:space:]]*"\{0,1\}\([^"[:space:])]*\).*/\2/p' | tail -n 1)
  a=no
  printf '%s\n' "$c" | grep -Eiq 'StreamDriverAuthMode[[:space:]]*=?[[:space:]]*"?x509/name' && a=yes
  echo "CA file: ${ca:-none}, x509/name authentication: $a"
  [ -n "$ca" ] && [ -s "$ca" ] && [ "$a" = yes ]

Remediation

1. Run apt-get install rsyslog-gnutls.
2. Copy the CA certificate of the log server to /etc/ssl/certs/log-ca.pem.
3. Create /etc/rsyslog.d/60-remote.conf:

   global(DefaultNetstreamDriverCAFile="/etc/ssl/certs/log-ca.pem")
   *.* action(type="omfwd" target="<server>" port="6514" protocol="tcp"
              StreamDriver="gtls" StreamDriverMode="1" StreamDriverAuthMode="x509/name"
              StreamDriverPermittedPeers="<server>"
              queue.type="LinkedList" queue.filename="fwd" queue.saveOnShutdown="on"
              action.resumeRetryCount="-1")
   

4. Run rsyslogd -N1 to check the syntax, then systemctl restart rsyslog.

Rollback

Remove /etc/rsyslog.d/60-remote.conf and restart rsyslog.

gnutls

Generated from check gnutls: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• rsyslog.conf(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R71) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-DEB-AUDIT-008 Send system logs to a remote log server

People and lifecycle