LowOS hardeningBLWK-LOG-002

System logs are not forwarded off-box

What this means

rsyslog has no remote forwarding rule configured — logs only exist locally. Anyone with root on this machine can edit or delete them, so local-only logging can't be trusted as evidence of what a root-level attacker did. A workstation has no central syslog to ship to, so this is scoped to the server profile; the point of off-box logs is that an attacker who roots the machine can't erase the record of how they got in, which only means something where someone is actually doing IR.

How to fix it

Add a forwarding rule to /etc/rsyslog.conf (e.g. *.* @@logs.example.com:514) pointing at a log destination this machine doesn't control.

Check it yourself

Run a scan and look for BLWK-LOG-002 in the results:

bulwark scan

Installed the standalone CLI package instead of the app? The command is bulwarkctl.

How Bulwark decides

Bulwark reads logging and reports this check when:

rsyslog_forwards_remote == false

If a value can't be read, Bulwark reports the check as undetermined rather than passing it. View the rule source.

Related checks

• Cron entry runs a downloader piped to a shell · BLWK-ACCT-001
• Password maximum age is excessively long · BLWK-ACCT-002
• Password minimum age is zero · BLWK-ACCT-003
• Password hashing rounds are not explicitly configured · BLWK-ACCT-004
• Default UMASK is not explicitly configured · BLWK-ACCT-005
• A sensitive system file is world-writable · BLWK-FS-001