Do not accept logs from other hosts

Description

Two services can receive logs from other hosts:

• systemd-journal-remote (package systemd-journal-remote), started by its socket unit systemd-journal-remote.socket or its service;
• rsyslog, when an input module for the network is loaded: imtcp, imudp or imrelp.

This control requires both to be off: the journal-remote units disabled or masked (or absent), and no network input in /etc/rsyslog.conf or /etc/rsyslog.d/*.conf.

systemd-journal-upload, which sends the local journal to a remote server, ships in the same package and is not affected.

Rationale

A receiver is a network service that parses untrusted input, and lets anyone who can reach the port inject false entries or flood the disk. Only a dedicated log server should run one.

Impact

Systems that are central log servers must be excluded from this control in the tailoring file.

Setting

Audit

1. Run systemctl is-enabled systemd-journal-remote.socket systemd-journal-remote.service. Each must print disabled, masked or report that the unit does not exist.
2. If rsyslog is installed, run grep -E '^\s*(module\(load="?im(tcp|udp|relp)|input\(type="?im(tcp|udp|relp)|\$ModLoad\s+im(tcp|udp|relp))' /etc/rsyslog.conf /etc/rsyslog.d/*.conf. It must print nothing.

Automated: every check must pass. Scanners report each check by its id.

journal-remote-socket

systemd-journal-remote.socket is not enabled.

unit: systemd-journal-remote.socket
state: disabled

journal-remote-service

systemd-journal-remote.service is not enabled.

unit: systemd-journal-remote.service
state: disabled

rsyslog-conf

No network input module in /etc/rsyslog.conf.

path: /etc/rsyslog.conf
pattern: ^\s*(module\(load="?im(tcp|udp|relp)|input\(type="?im(tcp|udp|relp)|\$ModLoad\s+im(tcp|udp|relp))
expect: no_match

rsyslog-dropins

No network input module in /etc/rsyslog.d/*.conf.

path: /etc/rsyslog.d/*.conf
pattern: ^\s*(module\(load="?im(tcp|udp|relp)|input\(type="?im(tcp|udp|relp)|\$ModLoad\s+im(tcp|udp|relp))
expect: no_match

Remediation

1. Run systemctl disable --now systemd-journal-remote.socket systemd-journal-remote.service, or remove the systemd-journal-remote package if systemd-journal-upload is not used.
2. In /etc/rsyslog.conf and /etc/rsyslog.d/*.conf, comment out the module(load="imtcp"), module(load="imudp"), module(load="imrelp") and matching input(...) lines, then run systemctl restart rsyslog.

Rollback

Run systemctl enable --now systemd-journal-remote.socket, and restore the rsyslog input lines.

journal-remote-socket

Generated from check journal-remote-socket: the engine writes the fix for every output, it sets the expected value and the check runs again after.

journal-remote-service

Generated from check journal-remote-service: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• systemd-journal-remote.service(8), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
• rsyslog.conf(5), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle