{
  "id": "CB-UBU-AUDIT-003",
  "standard": "ubuntu",
  "version": "0.1.0",
  "url": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-003",
  "json": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-003.json",
  "yaml": "https://baselines.cirsec.org/b/ubuntu/v0.1.0/CB-UBU-AUDIT-003.yml",
  "profiles_effective": [
    "core",
    "server",
    "server-hardened",
    "desktop",
    "desktop-hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-UBU-AUDIT-003",
    "title": "Do not accept logs from other hosts",
    "finding": {
      "title": "The system listens for log messages from the network",
      "description": "A log receiver opens a network port and lets any host write into the local logs, unless the system is a dedicated log server."
    },
    "status": "active",
    "profiles": [
      "core"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "automated",
    "tags": [
      "journald",
      "rsyslog",
      "logging",
      "network"
    ],
    "description": "Two services can receive logs from other hosts:\n\n- `systemd-journal-remote` (package `systemd-journal-remote`), started by its socket unit\n  `systemd-journal-remote.socket` or its service;\n- rsyslog, when an input module for the network is loaded: `imtcp`, `imudp` or `imrelp`.\n\nThis control requires both to be off: the journal-remote units disabled or masked (or absent),\nand no network input in `/etc/rsyslog.conf` or `/etc/rsyslog.d/*.conf`.\n",
    "rationale": "A receiver is a network service that parses untrusted input, and lets anyone who can reach the\nport inject false entries or flood the disk. Only a dedicated log server should run one.\n",
    "impact": "Systems that are central log servers must be excluded from this control in the tailoring file.\n",
    "notes": "`systemd-journal-upload`, which sends the local journal to a remote server, ships in the same\npackage and is not affected.\n",
    "setting": {
      "location": "systemd units systemd-journal-remote.socket/.service, /etc/rsyslog.conf, /etc/rsyslog.d/",
      "default_value": "Not installed, rsyslog network inputs commented out",
      "recommended_value": "Units disabled or absent, no imtcp/imudp/imrelp input"
    },
    "audit": {
      "manual": "1. Run `systemctl is-enabled systemd-journal-remote.socket systemd-journal-remote.service`. Each\n   must print `disabled`, `masked` or report that the unit does not exist.\n2. If rsyslog is installed, run\n   `grep -E '^\\s*(module\\(load=\"?im(tcp|udp|relp)|input\\(type=\"?im(tcp|udp|relp)|\\$ModLoad\\s+im(tcp|udp|relp))' /etc/rsyslog.conf /etc/rsyslog.d/*.conf`.\n   It must print nothing.\n",
      "checks": [
        {
          "id": "journal-remote-socket",
          "engine": "systemd-unit",
          "description": "systemd-journal-remote.socket is not enabled.",
          "spec": {
            "unit": "systemd-journal-remote.socket",
            "state": "disabled"
          }
        },
        {
          "id": "journal-remote-service",
          "engine": "systemd-unit",
          "description": "systemd-journal-remote.service is not enabled.",
          "spec": {
            "unit": "systemd-journal-remote.service",
            "state": "disabled"
          }
        },
        {
          "id": "rsyslog-conf",
          "engine": "file-content",
          "description": "No network input module in /etc/rsyslog.conf.",
          "facts": [
            "rsyslog"
          ],
          "spec": {
            "path": "/etc/rsyslog.conf",
            "pattern": "^\\s*(module\\(load=\"?im(tcp|udp|relp)|input\\(type=\"?im(tcp|udp|relp)|\\$ModLoad\\s+im(tcp|udp|relp))",
            "expect": "no_match"
          }
        },
        {
          "id": "rsyslog-dropins",
          "engine": "file-content",
          "description": "No network input module in /etc/rsyslog.d/*.conf.",
          "facts": [
            "rsyslog"
          ],
          "spec": {
            "path": "/etc/rsyslog.d/*.conf",
            "pattern": "^\\s*(module\\(load=\"?im(tcp|udp|relp)|input\\(type=\"?im(tcp|udp|relp)|\\$ModLoad\\s+im(tcp|udp|relp))",
            "expect": "no_match"
          }
        }
      ]
    },
    "remediation": {
      "manual": "1. Run `systemctl disable --now systemd-journal-remote.socket systemd-journal-remote.service`, or\n   remove the `systemd-journal-remote` package if `systemd-journal-upload` is not used.\n2. In `/etc/rsyslog.conf` and `/etc/rsyslog.d/*.conf`, comment out the `module(load=\"imtcp\")`,\n   `module(load=\"imudp\")`, `module(load=\"imrelp\")` and matching `input(...)` lines, then run\n   `systemctl restart rsyslog`.\n",
      "effects": {
        "restart": "none",
        "disruption": "low",
        "lockout_risk": false
      },
      "rollback": "Run `systemctl enable --now systemd-journal-remote.socket`, and restore the rsyslog input lines.\n",
      "scripts": [
        {
          "id": "journal-remote-socket",
          "from_check": "journal-remote-socket"
        },
        {
          "id": "journal-remote-service",
          "from_check": "journal-remote-service"
        }
      ]
    },
    "references": [
      {
        "title": "systemd-journal-remote.service(8), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man8/systemd-journal-remote.service.8.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      },
      {
        "title": "rsyslog.conf(5), Ubuntu manual pages",
        "url": "https://manpages.ubuntu.com/manpages/noble/man5/rsyslog.conf.5.html",
        "publisher": "Canonical",
        "kind": "vendor-doc",
        "accessed": "2026-10-19"
      }
    ],
    "mappings": [
      {
        "framework": "anssi-linux",
        "framework_version": "2.0",
        "id": "R71",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-7",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1562.006"
      },
      {
        "framework": "cwe",
        "id": "CWE-1327"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "verified": [
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "20.04"
        ],
        "environment": "Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic",
        "notes": "Passes on stock image (journal-remote absent, rsyslog network inputs commented out); kept after full remediation and reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "22.04"
        ],
        "environment": "Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic",
        "notes": "Passes on stock image (journal-remote absent, rsyslog network inputs commented out); kept after full remediation and reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "24.04"
        ],
        "environment": "Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic",
        "notes": "Passes on stock image (journal-remote absent, rsyslog network inputs commented out); kept after full remediation and reboot."
      },
      {
        "date": "2026-10-19",
        "by": "Sn0wAlice",
        "versions": [
          "26.04"
        ],
        "environment": "Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic",
        "notes": "Passes on stock image (journal-remote absent, rsyslog network inputs commented out); kept after full remediation and reboot."
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-19",
    "updated": "2026-10-19"
  }
}