# Ensure rsyslog is not configured to receive logs from a remote client

Necessity: Configuring a system to receive rsyslog messages from remote clients effectively turns it into a log server. If the system is not intended to be a log aggregator, enabling this feature needlessly increases its attack surface. It becomes vulnerable to Denial-of-Service (DoS) attacks through log flooding, which can exhaust disk space and CPU resources, leading to system instability. It could also be a vector for exploiting potential vulnerabilities in the rsyslog service itself.

Auditing and Remediation: The audit script inspects the rsyslog configuration files ('/etc/rsyslog.conf' and included files in '/etc/rsyslog.d/') for active directives that enable TCP or UDP listeners (e.g., '$ModLoad imtcp', '$InputTCPServerRun'). The remediation script programmatically comments out these specific directives to disable the listeners and then restarts the rsyslog service to ensure the new, more secure configuration is applied.

Recommended State Rationale: 
- Basic, Moderate, and Strict: All hardening levels recommend a state of 'disabled'. This recommendation is based on the principle of least privilege, which dictates that a system should only run services and expose ports that are essential for its designated function. Unless the machine's specific role is to act as a central log collector, there is no justification for exposing the rsyslog service to the network. Therefore, disabling this functionality is the only secure option, eliminating an unnecessary risk across all security postures.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['disabled']` |
| **Moderate** | `['disabled']` |
| **Strict** | `['disabled']` |
| **Type** | `ENUM` |

## Audit Script Working

Bash script that checks the '/etc/rsyslog.conf' and '/etc/rsyslog.d/*.conf' files. The script should determine if rsyslog is configured to listen for remote logs via UDP or TCP by searching for uncommented lines containing '$ModLoad imudp', '$UDPServerRun', '$ModLoad imtcp', or '$InputTCPServerRun'. If any of these are found and active, the script must output 'enabled'. Otherwise, it must output 'disabled'. The output must contain only the value 'enabled' or 'disabled'.

## Remediation Script Working

Bash script that accepts one positional argument specifying the desired state ('disabled'). If the argument is 'disabled', the script must locate and comment out any lines enabling remote log reception (e.g., '$ModLoad imudp', '$UDPServerRun', '$ModLoad imtcp', '$InputTCPServerRun') in '/etc/rsyslog.conf' and all files in '/etc/rsyslog.d/'. After modifying the configuration(s), the script must restart the rsyslog service to apply the changes. The script must output 'true' on successful completion and 'false' if it fails.

