CB-UBU-AUDIT-015: Send audit records to a remote server (v0.1.1)

Description

The au-remote plugin of audispd-plugins sends each audit record to a remote auditd that listens for them (tcp_listen_port on the server). It is turned on with active = yes in /etc/audit/plugins.d/au-remote.conf, and the server is set with remote_server in /etc/audit/audisp-remote.conf.

On Ubuntu 20.04 (auditd 2.8), the plugins are run by audispd and their files live in /etc/audisp/: /etc/audisp/plugins.d/au-remote.conf and /etc/audisp/audisp-remote.conf. From 22.04 (auditd 3) they are under /etc/audit/.

The fix is manual: the server address, port and transport (Kerberos or plain TCP inside a protected network) depend on the site. Forwarding audit records through rsyslog with TLS (syslog plugin and CB-UBU-AUDIT-009) is an accepted alternative; record it as an exception in the tailoring file.

Rationale

A copy kept off the system cannot be erased by an intruder who has taken root, and lets audit records from many systems be reviewed in one place.

Impact

Requires an audit collection server and a network flow to it (TCP 60 by default). Configure network_failure_action and the queue in audisp-remote.conf so an outage does not block the system.

Setting

Location	/etc/audit/plugins.d/au-remote.conf, /etc/audit/audisp-remote.conf (20.04 - /etc/audisp/plugins.d/au-remote.conf, /etc/audisp/audisp-remote.conf)
Default	active = no, remote_server empty
Recommended	active = yes, remote_server set to the audit collection server

Audit

Run grep -E '^\s*active' /etc/audit/plugins.d/au-remote.conf. It must print active = yes.
Run grep -E '^\s*remote_server' /etc/audit/audisp-remote.conf. It must name the server. On Ubuntu 20.04, read the same settings in /etc/audisp/plugins.d/au-remote.conf and /etc/audisp/audisp-remote.conf.
On the server, check that records from this system arrive.

Automated: every check must pass. Scanners report each check by its id.

`plugin-active`

The au-remote plugin is active.

engine: File content22.0424.0426.04

path: /etc/audit/plugins.d/au-remote.conf
pattern: ^\s*active\s*=\s*yes\s*$

`remote-server`

A remote server is set.

engine: File content22.0424.0426.04

path: /etc/audit/audisp-remote.conf
pattern: ^\s*remote_server\s*=\s*\S+

`plugin-active-audisp`

The au-remote plugin is active (auditd 2.8, plugins under /etc/audisp).

engine: File content20.04

path: /etc/audisp/plugins.d/au-remote.conf
pattern: ^\s*active\s*=\s*yes\s*$

`remote-server-audisp`

A remote server is set (auditd 2.8, plugins under /etc/audisp).

engine: File content20.04

path: /etc/audisp/audisp-remote.conf
pattern: ^\s*remote_server\s*=\s*\S+

Remediation

Set remote_server = <server> (and port, transport) in /etc/audit/audisp-remote.conf.
Set active = yes in /etc/audit/plugins.d/au-remote.conf. On Ubuntu 20.04, edit /etc/audisp/audisp-remote.conf and /etc/audisp/plugins.d/au-remote.conf.
Run systemctl restart auditd, then check on the server that records arrive.

Rollback

Set active = no in /etc/audit/plugins.d/au-remote.conf and restart auditd.

References

audisp-remote.conf(5), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19
auditd.conf(5), Ubuntu manual pages Canonical, vendor-doc, accessed 2026-10-19

Mappings

Framework	ID	Relation
ANSSI-BP-028 - Recommandations de configuration d'un système GNU/Linux2.0	`R73`	related
NIST SP 800-53 Rev. 55.1.1	`AU-4(1)`	equivalent
NIST SP 800-53 Rev. 55.1.1	`AU-9(2)`	related

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Taxonomy	ID
MITRE ATT&CK	`T1070.002`
MITRE ATT&CK	`T1562.012`

requires CB-UBU-AUDIT-011 Install and run the audit daemon

People and lifecycle

Authors	Alice@Sn0wAlice
Verified	2026-10-19 by Sn0wAlice on 20.04, Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic. Fails after auditd install (plugin inactive); passes once active = yes and remote_server are set by hand in /etc/audisp/.
Verified	2026-10-19 by Sn0wAlice on 22.04, Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic. Fails after auditd install (plugin inactive), as expected; fix is manual.
Verified	2026-10-19 by Sn0wAlice on 24.04, Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic. Fails after auditd install (plugin inactive), as expected; fix is manual.
Verified	2026-10-19 by Sn0wAlice on 26.04, Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic. Fails after auditd install (plugin inactive), as expected; fix is manual.
Introduced in	v0.1.0
Created, updated	2026-10-19, 2026-10-19
Translations	`fr`