Cis Ubuntu1604 V200 4 2 2 3

CIS Ubuntu Linux 16.04 LTS Benchmark v2.0.0 - Control 4.2.2.3

Profile

• Level: 1 - Server
• Level: 1 - Workstation
• Assessment Status: Automated

Description

Data from journald may be stored in volatile memory or persisted locally on the server. Logs in memory will be lost upon a system reboot. By persisting logs to local disk on the server they are protected from loss.

Note: The main configuration file /etc/systemd/journald.conf is read before any of the custom *.conf files. If there are custom configs present, they override the main configuration parameters.

Rationale

Writing log data to disk will provide the ability to forensically reconstruct events which may have impacted the operations or security of a system even after a system crash or reboot.

Impact

None.

Audit Procedure

Review /etc/systemd/journald.conf and verify that logs are persisted to disk:

Command Line

grep -e Storage /etc/systemd/journald.conf

Expected Result

Storage=persistent

Remediation

Edit the /etc/systemd/journald.conf file and add the following line:

Command Line

# Add or update the following in /etc/systemd/journald.conf:
Storage=persistent

Default Value

Storage is set to auto by default, which means journal data is stored in /var/log/journal/ if the directory exists.

References

1. https://github.com/konstruktoid/hardening/blob/master/systemd.adoc#etcsystemdjournaldconf

CIS Controls