# Ensure rsyslog is not configured to receive logs from a remote client

Necessity: Configuring a system to receive logs from remote clients effectively turns it into a log server. If the system is not intended for this role, enabling this feature unnecessarily increases its attack surface by opening network ports (typically UDP/514 or TCP/514). This can expose the rsyslog service to network-based attacks, including Denial of Service (DoS) attacks where an attacker floods the system with log messages, potentially exhausting disk space, memory, or CPU resources. Disabling remote log reception adheres to the principle of least functionality, reducing the system's exposure to potential threats. Auditing and Remediation: The audit script scans all rsyslog configuration files to detect active listener directives for either UDP or TCP protocols. The remediation script disables this functionality by locating and commenting out the relevant configuration lines and then restarting the rsyslog service to apply the change, effectively closing the network listeners. Recommended State Rationale: The recommended state for Basic, Moderate, and Strict levels is 'disabled'. This is a binary security control. Unless a system is explicitly designated, secured, and monitored as a centralized log server, it should never be configured to accept logs from external sources. There is no secure intermediate state; the functionality should be turned off to minimize risk. Therefore, 'disabled' is the only appropriate recommendation for any system not fulfilling that specific role.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['disabled']` |
| **Strict** | `['disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that inspects the `/etc/rsyslog.conf` file and all files within the `/etc/rsyslog.d/` directory. The script must determine if rsyslog is configured to receive remote logs by checking for uncommented lines containing directives such as `$ModLoad imudp`, `$UDPServerRun`, `$ModLoad imtcp`, `$InputTCPServerRun`, `module(load="imudp")`, `input(type="imudp" ...)` ,`module(load="imtcp")`, or `input(type="imtcp" ...)` . The script must output `enabled` if remote logging is configured, and `disabled` if it is not. The output must contain only one of these two words.

## Remediation Script Working

Bash script that accepts a single positional argument, which must be `disabled`. The script must search `/etc/rsyslog.conf` and all files in `/etc/rsyslog.d/` for uncommented directives that enable remote log reception (e.g., `$ModLoad imudp`, `$UDPServerRun`, `$ModLoad imtcp`, `$InputTCPServerRun`, and their modern `module()`/`input()` equivalents). It must comment out these lines to disable the feature. After modifying the configuration, the script must restart the rsyslog service. The script must return `true` on successful completion and `false` if it fails.

