# yaml-language-server: $schema=../../../../schema/control.schema.json
id: CB-UBU-AUDIT-015
title: Send audit records to a remote server
finding:
  title: Audit records are only stored on the audited system
  description: Someone who gains root on the system can erase or alter the audit log, the only copy of the evidence.
status: active
profiles: [server-hardened]
risk:
  severity: medium
assessment: automated
tags: [auditd, remote]

description: |
  The `au-remote` plugin of `audispd-plugins` sends each audit record to a remote `auditd` that
  listens for them (`tcp_listen_port` on the server). It is turned on with `active = yes` in
  `/etc/audit/plugins.d/au-remote.conf`, and the server is set with `remote_server` in
  `/etc/audit/audisp-remote.conf`.
rationale: |
  A copy kept off the system cannot be erased by an intruder who has taken root, and lets audit
  records from many systems be reviewed in one place.
impact: |
  Requires an audit collection server and a network flow to it (TCP 60 by default). Configure
  `network_failure_action` and the queue in `audisp-remote.conf` so an outage does not block the
  system.
notes: |
  On Ubuntu 20.04 (auditd 2.8), the plugins are run by `audispd` and their files live in
  `/etc/audisp/`: `/etc/audisp/plugins.d/au-remote.conf` and `/etc/audisp/audisp-remote.conf`.
  From 22.04 (auditd 3) they are under `/etc/audit/`.

  The fix is manual: the server address, port and transport (Kerberos or plain TCP inside a
  protected network) depend on the site. Forwarding audit records through rsyslog with TLS
  (syslog plugin and CB-UBU-AUDIT-009) is an accepted alternative; record it as an exception in
  the tailoring file.

setting:
  location: /etc/audit/plugins.d/au-remote.conf, /etc/audit/audisp-remote.conf (20.04 - /etc/audisp/plugins.d/au-remote.conf, /etc/audisp/audisp-remote.conf)
  default_value: active = no, remote_server empty
  recommended_value: active = yes, remote_server set to the audit collection server

audit:
  manual: |
    1. Run `grep -E '^\s*active' /etc/audit/plugins.d/au-remote.conf`. It must print `active = yes`.
    2. Run `grep -E '^\s*remote_server' /etc/audit/audisp-remote.conf`. It must name the server.
    On Ubuntu 20.04, read the same settings in `/etc/audisp/plugins.d/au-remote.conf` and
    `/etc/audisp/audisp-remote.conf`.
    3. On the server, check that records from this system arrive.
  checks:
    - id: plugin-active
      engine: file-content
      description: The au-remote plugin is active.
      versions: ["22.04", "24.04", "26.04"]
      spec:
        path: /etc/audit/plugins.d/au-remote.conf
        pattern: '^\s*active\s*=\s*yes\s*$'
    - id: remote-server
      engine: file-content
      description: A remote server is set.
      versions: ["22.04", "24.04", "26.04"]
      spec:
        path: /etc/audit/audisp-remote.conf
        pattern: '^\s*remote_server\s*=\s*\S+'
    - id: plugin-active-audisp
      engine: file-content
      description: The au-remote plugin is active (auditd 2.8, plugins under /etc/audisp).
      versions: ["20.04"]
      spec:
        path: /etc/audisp/plugins.d/au-remote.conf
        pattern: '^\s*active\s*=\s*yes\s*$'
    - id: remote-server-audisp
      engine: file-content
      description: A remote server is set (auditd 2.8, plugins under /etc/audisp).
      versions: ["20.04"]
      spec:
        path: /etc/audisp/audisp-remote.conf
        pattern: '^\s*remote_server\s*=\s*\S+'

remediation:
  manual: |
    1. Set `remote_server = <server>` (and `port`, `transport`) in `/etc/audit/audisp-remote.conf`.
    2. Set `active = yes` in `/etc/audit/plugins.d/au-remote.conf`.
    On Ubuntu 20.04, edit `/etc/audisp/audisp-remote.conf` and `/etc/audisp/plugins.d/au-remote.conf`.
    3. Run `systemctl restart auditd`, then check on the server that records arrive.
  rollback: |
    Set `active = no` in `/etc/audit/plugins.d/au-remote.conf` and restart auditd.

references:
  - title: audisp-remote.conf(5), Ubuntu manual pages
    url: https://manpages.ubuntu.com/manpages/noble/man5/audisp-remote.conf.5.html
    publisher: Canonical
    kind: vendor-doc
    accessed: 2026-10-19
  - title: auditd.conf(5), Ubuntu manual pages
    url: https://manpages.ubuntu.com/manpages/noble/man5/auditd.conf.5.html
    publisher: Canonical
    kind: vendor-doc
    accessed: 2026-10-19
mappings:
  - framework: anssi-linux
    framework_version: "2.0"
    id: R73
    relation: related
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AU-4(1)
    relation: equivalent
  - framework: nist-800-53r5
    framework_version: "5.1.1"
    id: AU-9(2)
    relation: related
threats:
  - framework: mitre-attack
    id: T1070.002
  - framework: mitre-attack
    id: T1562.012
related_controls:
  - id: CB-UBU-AUDIT-011
    type: requires

authors:
  - name: Alice
    github: Sn0wAlice
verified:
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["20.04"]
    environment: Proxmox VM, Ubuntu 20.04 cloud image, kernel 5.4.0-216-generic
    notes: "Fails after auditd install (plugin inactive); passes once active = yes and remote_server are set by hand in /etc/audisp/."
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["22.04"]
    environment: Proxmox VM, Ubuntu 22.04 cloud image, kernel 5.15.0-198-generic
    notes: "Fails after auditd install (plugin inactive), as expected; fix is manual."
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["24.04"]
    environment: Proxmox VM, Ubuntu 24.04 cloud image, kernel 6.8.0-147-generic
    notes: "Fails after auditd install (plugin inactive), as expected; fix is manual."
  - date: 2026-10-19
    by: Sn0wAlice
    versions: ["26.04"]
    environment: Proxmox VM, Ubuntu 26.04 cloud image, kernel 7.0.0-38-generic
    notes: "Fails after auditd install (plugin inactive), as expected; fix is manual."
introduced_in: 0.1.0
created: 2026-10-19
updated: 2026-10-19