{
  "id": "CB-UBU-AUDIT-002",
  "standard": "ubuntu",
  "version": "0.1.0",
  "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-002",
  "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-002.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-002.yml",
  "profiles_effective": [
    "core",
    "server",
    "server-hardened",
    "desktop",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-AUDIT-002",
    "title": "Forward the journal to rsyslog only when rsyslog is the chosen logger",
    "finding": {
      "title": "The journal forwarding setting does not match the logging system in use",
      "description": "Messages are either sent to a syslog daemon that does not exist, or not given to the rsyslog daemon that is supposed to store and forward them."
    },
    "status": "active",
    "profiles": [
      "core"
    ],
    "risk": {
      "severity": "low"
    },
    "assessment": "automated",
    "tags": [
      "journald",
      "rsyslog",
      "logging"
    ],
    "description": "An Ubuntu system should use one logging system: the systemd journal alone, or the journal\nfeeding rsyslog, which then writes text files and forwards messages. The journald setting\n`ForwardToSyslog=` decides whether each message is also handed to a syslog daemon.\n\n- When the `rsyslog` package is installed, `ForwardToSyslog=yes` is required, so that rsyslog\n  receives every message.\n- When it is not installed, `ForwardToSyslog=no` is required, since nothing reads the\n  forwarded messages.\n",
    "rationale": "A mismatch either loses messages in the files and remote copies managed by rsyslog, or wastes\nresources on a socket nobody reads. Choosing one system keeps the log pipeline simple to review.\n",
    "impact": "None known. The journal keeps every message in both cases.\n",
    "notes": "Ubuntu Server installs rsyslog by default. On Ubuntu 20.04 and 22.04, journald is built with\n`ForwardToSyslog=yes` as its default (shown commented out in `/etc/systemd/journald.conf`); from\n24.04 the built-in default is `no` and the rsyslog package ships\n`/usr/lib/systemd/journald.conf.d/syslog.conf` with `ForwardToSyslog=yes`. The check takes the\nbuilt-in default into account when no file sets the value. The fix writes\n`/etc/systemd/journald.conf.d/syslog.conf`, which replaces the file shipped by rsyslog.\n",
    "setting": {
      "location": "/etc/systemd/journald.conf.d/syslog.conf",
      "default_value": "yes (rsyslog installed by default)",
      "recommended_value": "yes when rsyslog is installed, no otherwise"
    },
    "audit": {
      "manual": "1. Run `dpkg-query -W -f='${Status}\\n' rsyslog` to know whether rsyslog is installed.\n2. Run `systemd-analyze cat-config systemd/journald.conf`. The last `ForwardToSyslog=` must be\n   `yes` if rsyslog is installed, and `no` (or absent) otherwise.\n",
      "checks": [
        {
          "id": "forward",
          "engine": "shell",
          "description": "Effective ForwardToSyslog= compared with the presence of rsyslog.",
          "spec": {
            "script": "v=$(systemd-analyze cat-config systemd/journald.conf 2>/dev/null | sed -n 's/^[[:space:]]*ForwardToSyslog=//p' | tail -n 1)\n# unset: the build default, shown commented out in journald.conf (yes on 20.04 and 22.04)\n[ -n \"$v\" ] || v=$(sed -n 's/^#ForwardToSyslog=//p' /etc/systemd/journald.conf 2>/dev/null | head -n 1)\ncase ${v:-no} in yes | true | on | 1) v=yes ;; *) v=no ;; esac\ncase $(dpkg-query -W -f='${Status}' rsyslog 2>/dev/null) in\n  *' installed') want=yes ;;\n  *) want=no ;;\nesac\necho \"ForwardToSyslog=$v, expected $want\"\n[ \"$v\" = \"$want\" ]\n"
          }
        }
      ]
    },
    "remediation": {
      "manual": "Create `/etc/systemd/journald.conf.d/syslog.conf` with `[Journal]` and `ForwardToSyslog=yes` if\nrsyslog is installed, `ForwardToSyslog=no` otherwise, then run `systemctl restart systemd-journald`.\n",
      "effects": {
        "restart": "service",
        "services": [
          "systemd-journald"
        ],
        "disruption": "none",
        "lockout_risk": false
      },
      "rollback": "Delete `/etc/systemd/journald.conf.d/syslog.conf` and run `systemctl restart systemd-journald`.\n",
      "scripts": [
        {
          "id": "dropin",
          "engine": "shell",
          "content": "case $(dpkg-query -W -f='${Status}' rsyslog 2>/dev/null) in\n  *' installed') v=yes ;;\n  *) v=no ;;\nesac\nf=/etc/systemd/journald.conf.d/syslog.conf\nmkdir -p /etc/systemd/journald.conf.d\ncb_backup \"$f\"\nprintf '%s\\n' '# Written by CIRSEC Baselines CB-UBU-AUDIT-002' '[Journal]' \"ForwardToSyslog=$v\" >\"$f\"\nchmod 644 \"$f\"\n"
        }
      ]
    },
    "references": [
      {
        "title": "journald.conf(5), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man5/journald.conf.5.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "rsyslogd(8), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man8/rsyslogd.8.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-linux",
        "framework_version": "2.0",
        "id": "R71",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AU-6(4)",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "cwe",
        "id": "CWE-778"
      }
    ],
    "related_controls": [
      {
        "id": "CB-UBU-AUDIT-001",
        "type": "related"
      },
      {
        "id": "CB-UBU-AUDIT-005",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic",
        "notes": "rsyslog installed, built-in default ForwardToSyslog=yes: passes on stock image (check reads the commented build default)."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic",
        "notes": "Passes on stock image (built-in default yes, rsyslog installed); after removing rsyslog fails, fix writes ForwardToSyslog=no and passes."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic",
        "notes": "Passes on stock image (rsyslog ships journald.conf.d/syslog.conf with ForwardToSyslog=yes); kept after reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic",
        "notes": "Passes on stock image (rsyslog ships journald.conf.d/syslog.conf with ForwardToSyslog=yes); kept after reboot."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}