Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Ubuntu 24.04 6.1.2.1.2 Ensure systemd-journal-upload authentication #12852

Open
wants to merge 3 commits into
base: master
Choose a base branch
from
+185 −20
Open

Ubuntu 24.04 6.1.2.1.2 Ensure systemd-journal-upload authentication #12852

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
f123a94
Ubuntu 24.04 6.1.2.1.2 Ensure systemd-journal-upload authentication i…
ericeberry Jan 17, 2025
53a6846
Ubuntu 24.04 6.1.2.1.2 Ensure systemd-journal-upload authentication i…
ericeberry Jan 21, 2025
c15a18c
Ubuntu 24.04 6.1.2.1.2 Ensure systemd-journal-upload authentication i…
ericeberry Jan 22, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions controls/cis_ubuntu2404.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2288,8 +2288,10 @@ controls:
levels:
- l1_server
- l1_workstation
status: planned
notes: TODO. Rule does not seem to be implemented. Analogous to ubuntu2204/4.2.1.1.2.
rules:
- systemd_journal_upload_server_tls
- systemd_journal_upload_url
status: automated

- id: 6.1.2.1.3
title: Ensure systemd-journal-upload is enabled and active (Automated)
Expand Down
9 changes: 5 additions & 4 deletions linux_os/guide/system/logging/journald/systemd_journal_upload_server_tls/bash/shared.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,10 +1,11 @@
# platform = multi_platform_slmicro
# platform = multi_platform_slmicro,multi_platform_ubuntu

{{{ bash_instantiate_variables("var_journal_upload_conf_file") }}}
{{{ bash_instantiate_variables("var_journal_upload_server_key_file") }}}
{{{ bash_replace_or_append('/etc/systemd/journal-upload.conf', '^ServerKeyFile', "$var_journal_upload_server_key_file", '%s=%s') }}}
{{{ bash_replace_or_append('$var_journal_upload_conf_file', '^ServerKeyFile', "$var_journal_upload_server_key_file", '%s=%s') }}}

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These changes would affect slmicro too.
Use a ubuntu-specific remediation file (ubuntu.sh) or place the code inside conditionals, e.g.

{{% if 'ubuntu' in product %}}
{{{ bash_instantiate_variables("var_journal_upload_conf_file") }}}
{{% else %}}
var_journal_upload_conf_file=/etc/systemd/journal-upload.conf
{{% endif %}}

That said, I couldn't find the XCCDF variable var_journal_upload_conf_file in the codebase.
If you want to introduce a new variable you need to create it, analogous to /linux_os/guide/system/logging/journald/var_journal_upload_url.var.

For this specific case, I wouldn't recommend using an XCCDF variable though, since config file locations are not something that we generally let the users specify at runtime. Config file paths are mostly hardcoded into the rules. If they differ across OS-es they can be defined via conditionals or via Jinja variables defined in product.yml files.

Copy link
Contributor Author

@ericeberry ericeberry Jan 22, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This should be the file you were looking for (that I created): https://github.com/ComplianceAsCode/content/blob/53a6846f6f0f92cc4bbafd56246c32af110f6e8c/linux_os/guide/system/logging/journald/var_journal_upload_conf_file.var

Doesn't the default setting take care of the slmicro case?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Probably 95% of the time, I would think they use the default filename (/etc/systemd/journal-update.conf). But I think the new way of configuring is to create a file in the /etc/systemd/journal-update.conf.d directory now. I needed to be able to change the name of the file for the tests so that I could specify files in the conf.d directory.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Correct, if you define the default as you did now this will make the slmicro5 remediation work as before, but only as long as the end user doesn't modify the XCCDF variable. I'm not sure if SUSE want this path to be modifiable. If they do, then the ansible remediation also needs to be adjusted, since it will not work the same way the bash remediation works on slmicro5 at the moment.

Regarding introducing the new XCCDF variable for the config file - the only other instance I could find in linux_os is var_nftables_master_config_file. This approach is not very common in CaC, but it does have the advantage that the user can define a custom path for their config if needed. It's not needed for tests though. Instead of hardcoding the variable override in # variables, it would work equally to hardcode the paths in separate scenarios, similar to how it's done in sshd_lineinfile template, e.g.

  • missing-servercert.fail.sh: wipes all configs in .d directory and writes to /etc/systemd/journal-upload.conf
  • missing-servercert-confd.fail.sh: writes to /etc/systemd/journal-upload.conf.d/60-journald_upload.conf and wipes the contents of /etc/systemd/journal-upload.conf

{{{ bash_instantiate_variables("var_journal_upload_server_certificate_file") }}}
{{{ bash_replace_or_append('/etc/systemd/journal-upload.conf', '^ServerCertificateFile', "$var_journal_upload_server_certificate_file", '%s=%s') }}}
{{{ bash_replace_or_append('$var_journal_upload_conf_file', '^ServerCertificateFile', "$var_journal_upload_server_certificate_file", '%s=%s') }}}

{{{ bash_instantiate_variables("var_journal_upload_server_trusted_certificate_file") }}}
{{{ bash_replace_or_append('/etc/systemd/journal-upload.conf', '^TrustedCertificateFile', "$var_journal_upload_server_trusted_certificate_file", '%s=%s') }}}
{{{ bash_replace_or_append('$var_journal_upload_conf_file', '^TrustedCertificateFile', "$var_journal_upload_server_trusted_certificate_file", '%s=%s') }}}
6 changes: 3 additions & 3 deletions linux_os/guide/system/logging/journald/systemd_journal_upload_server_tls/oval/shared.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,7 @@
</ind:textfilecontent54_test>

<ind:textfilecontent54_object id="object_systemd_journal_upload_server_key_file" version="2">
<ind:filepath>/etc/systemd/journal-upload.conf</ind:filepath>
<ind:filepath operation="pattern match">^/etc/systemd/journal-upload.conf(\.d/[^/]+\.conf)?$</ind:filepath>
ericeberry marked this conversation as resolved.
Show resolved Hide resolved
<ind:pattern operation="pattern match">^\s*ServerKeyFile\s*=\s*(.*)\s*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
Expand All @@ -39,7 +39,7 @@
</ind:textfilecontent54_test>

<ind:textfilecontent54_object id="object_systemd_journal_upload_server_certificate_file" version="2">
<ind:filepath>/etc/systemd/journal-upload.conf</ind:filepath>
<ind:filepath operation="pattern match">^/etc/systemd/journal-upload.conf(\.d/[^/]+\.conf)?$</ind:filepath>
<ind:pattern operation="pattern match">^\s*ServerCertificateFile\s*=\s*(.*)\s*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
Expand All @@ -58,7 +58,7 @@
</ind:textfilecontent54_test>

<ind:textfilecontent54_object id="object_systemd_journal_upload_server_trusted_certificate_file" version="2">
<ind:filepath>/etc/systemd/journal-upload.conf</ind:filepath>
<ind:filepath operation="pattern match">^/etc/systemd/journal-upload.conf(\.d/[^/]+\.conf)?$</ind:filepath>
<ind:pattern operation="pattern match">^\s*TrustedCertificateFile\s*=\s*(.*)\s*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
Expand Down
5 changes: 3 additions & 2 deletions linux_os/guide/system/logging/journald/systemd_journal_upload_server_tls/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
documentation_complete: true

title: 'Configure systemd-journal-upload TLS parameters: ServerKeyFile,ServerCertificateFile and TrustedCertificateFile'
title: 'Configure systemd-journal-upload TLS parameters: ServerKeyFile, ServerCertificateFile and TrustedCertificateFile'

description: |-
{{{ full_name }}} must offload rsyslog messages for networked systems in real time and
Expand All @@ -22,7 +22,7 @@ ocil_clause: 'systemd-journal-upload TLS configuration is missing or commented i

ocil: |-
To ensure logs are sent securely to a remote host, examine the file
<tt>/etc/systemd/journal-upload.conf</tt>.
<tt>{{{ xccdf_value("var_journal_upload_conf_file") }}}</tt>.
ServerKeyFile should be present:
<pre>ServerKeyFile={{{ xccdf_value("var_journal_upload_server_key_file") }}}</pre>
ServerCertificateFile should be present:
Expand All @@ -31,6 +31,7 @@ ocil: |-
<pre>TrustedCertificateFile={{{ xccdf_value("var_journal_upload_server_trusted_certificate_file") }}}</pre>

fixtext: |-
Configure systemd-journal-upload config file to {{{ xccdf_value("var_journal_upload_conf_file") }}}.
Configure systemd-journal-upload ServerKeyFile to {{{ xccdf_value("var_journal_upload_server_key_file") }}}
Configure systemd-journal-upload ServerCertificateFile to {{{ xccdf_value("var_journal_upload_server_certificate_file") }}}
Configure systemd-journal-upload TrustedCertificateFile to {{{ xccdf_value("var_journal_upload_server_trusted_certificate_file") }}}
12 changes: 12 additions & 0 deletions ...e/system/logging/journald/systemd_journal_upload_server_tls/tests/journald-conf-d.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
#!/bin/bash
# packages = systemd-journal-remote
# variables = var_journal_upload_conf_file=/etc/systemd/journal-upload.conf.d/60-journald_upload.conf,var_journal_upload_server_key_file=/etc/ssl/private/journal-upload.pem,var_journal_upload_server_certificate_file=/etc/ssl/certs/journal-upload.pem,var_journal_upload_server_trusted_certificate_file=/etc/ssl/ca/trusted.pem

a_settings=("URL=192.168.50.42" "ServerKeyFile=/etc/ssl/private/journal-upload.pem" \
"ServerCertificateFile=/etc/ssl/certs/journal-upload.pem" "TrustedCertificateFile=/etc/ssl/ca/trusted.pem")
[ ! -d /etc/systemd/journal-upload.conf.d/ ] && mkdir /etc/systemd/journal-upload.conf.d/
if grep -Psq -- '^\h*\[Upload\]' /etc/systemd/journal-upload.conf.d/60-journald_upload.conf; then
printf '%s\n' "" "${a_settings[@]}" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf
else
printf '%s\n' "" "[Upload]" "${a_settings[@]}" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf
fi
12 changes: 12 additions & 0 deletions ...journald/systemd_journal_upload_server_tls/tests/journald-conf-servercert-missing.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
#!/bin/bash
# packages = systemd-journal-remote
# variables = var_journal_upload_conf_file=/etc/systemd/journal-upload.conf.d/60-journald_upload.conf,var_journal_upload_server_key_file=/etc/ssl/private/journal-upload.pem,var_journal_upload_server_certificate_file=/etc/ssl/certs/journal-upload.pem,var_journal_upload_server_trusted_certificate_file=/etc/ssl/ca/trusted.pem

a_settings=("URL=192.168.50.42" "ServerKeyFile=/etc/ssl/private/journal-upload.pem" \
"TrustedCertificateFile=/etc/ssl/ca/trusted.pem")
[ ! -d /etc/systemd/journal-upload.conf.d/ ] && mkdir /etc/systemd/journal-upload.conf.d/
if grep -Psq -- '^\h*\[Upload\]' /etc/systemd/journal-upload.conf.d/60-journald_upload.conf; then
printf '%s\n' "" "${a_settings[@]}" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf
else
printf '%s\n' "" "[Upload]" "${a_settings[@]}" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf
fi
12 changes: 12 additions & 0 deletions ...logging/journald/systemd_journal_upload_server_tls/tests/journald-conf-servercert.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
#!/bin/bash
# packages = systemd-journal-remote
# variables = var_journal_upload_conf_file=/etc/systemd/journal-upload.conf.d/60-journald_upload.conf,var_journal_upload_server_key_file=/etc/ssl/private/journal-upload.pem,var_journal_upload_server_certificate_file=/etc/ssl/certs/journal-upload.pem,var_journal_upload_server_trusted_certificate_file=/etc/ssl/ca/trusted.pem

a_settings=("URL=192.168.50.42" "ServerKeyFile=/etc/ssl/private/journal-upload.pem" \
"ServerCertificateFile=/etc/ssl/certs/journal-upload1.pem" "TrustedCertificateFile=/etc/ssl/ca/trusted.pem")
[ ! -d /etc/systemd/journal-upload.conf.d/ ] && mkdir /etc/systemd/journal-upload.conf.d/
if grep -Psq -- '^\h*\[Upload\]' /etc/systemd/journal-upload.conf.d/60-journald_upload.conf; then
printf '%s\n' "" "${a_settings[@]}" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf
else
printf '%s\n' "" "[Upload]" "${a_settings[@]}" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf
fi
12 changes: 12 additions & 0 deletions .../journald/systemd_journal_upload_server_tls/tests/journald-conf-serverkey-missing.fail sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
#!/bin/bash
# packages = systemd-journal-remote
# variables = var_journal_upload_conf_file=/etc/systemd/journal-upload.conf.d/60-journald_upload.conf,var_journal_upload_server_key_file=/etc/ssl/private/journal-upload.pem,var_journal_upload_server_certificate_file=/etc/ssl/certs/journal-upload.pem,var_journal_upload_server_trusted_certificate_file=/etc/ssl/ca/trusted.pem

a_settings=("URL=192.168.50.42" \
"ServerCertificateFile=/etc/ssl/certs/journal-upload.pem" "TrustedCertificateFile=/etc/ssl/ca/trusted.pem")
[ ! -d /etc/systemd/journal-upload.conf.d/ ] && mkdir /etc/systemd/journal-upload.conf.d/
if grep -Psq -- '^\h*\[Upload\]' /etc/systemd/journal-upload.conf.d/60-journald_upload.conf; then
printf '%s\n' "" "${a_settings[@]}" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf
else
printf '%s\n' "" "[Upload]" "${a_settings[@]}" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf
fi
12 changes: 12 additions & 0 deletions .../logging/journald/systemd_journal_upload_server_tls/tests/journald-conf-serverkey.fail sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
#!/bin/bash
# packages = systemd-journal-remote
# variables = var_journal_upload_conf_file=/etc/systemd/journal-upload.conf.d/60-journald_upload.conf,var_journal_upload_server_key_file=/etc/ssl/private/journal-upload.pem,var_journal_upload_server_certificate_file=/etc/ssl/certs/journal-upload.pem,var_journal_upload_server_trusted_certificate_file=/etc/ssl/ca/trusted.pem

a_settings=("URL=192.168.50.42" "ServerKeyFile=/etc/ssl/private/journal-upload1.pem" \
"ServerCertificateFile=/etc/ssl/certs/journal-upload.pem" "TrustedCertificateFile=/etc/ssl/ca/trusted.pem")
[ ! -d /etc/systemd/journal-upload.conf.d/ ] && mkdir /etc/systemd/journal-upload.conf.d/
if grep -Psq -- '^\h*\[Upload\]' /etc/systemd/journal-upload.conf.d/60-journald_upload.conf; then
printf '%s\n' "" "${a_settings[@]}" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf
else
printf '%s\n' "" "[Upload]" "${a_settings[@]}" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf
fi
12 changes: 12 additions & 0 deletions ...ournald/systemd_journal_upload_server_tls/tests/journald-conf-trustedcert-missing.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
#!/bin/bash
# packages = systemd-journal-remote
# variables = var_journal_upload_conf_file=/etc/systemd/journal-upload.conf.d/60-journald_upload.conf,var_journal_upload_server_key_file=/etc/ssl/private/journal-upload.pem,var_journal_upload_server_certificate_file=/etc/ssl/certs/journal-upload.pem,var_journal_upload_server_trusted_certificate_file=/etc/ssl/ca/trusted.pem

a_settings=("URL=192.168.50.42" "ServerKeyFile=/etc/ssl/private/journal-upload.pem" \
"ServerCertificateFile=/etc/ssl/certs/journal-upload.pem")
[ ! -d /etc/systemd/journal-upload.conf.d/ ] && mkdir /etc/systemd/journal-upload.conf.d/
if grep -Psq -- '^\h*\[Upload\]' /etc/systemd/journal-upload.conf.d/60-journald_upload.conf; then
printf '%s\n' "" "${a_settings[@]}" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf
else
printf '%s\n' "" "[Upload]" "${a_settings[@]}" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf
fi
12 changes: 12 additions & 0 deletions ...ogging/journald/systemd_journal_upload_server_tls/tests/journald-conf-trustedcert.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
#!/bin/bash
# packages = systemd-journal-remote
# variables = var_journal_upload_conf_file=/etc/systemd/journal-upload.conf.d/60-journald_upload.conf,var_journal_upload_server_key_file=/etc/ssl/private/journal-upload.pem,var_journal_upload_server_certificate_file=/etc/ssl/certs/journal-upload.pem,var_journal_upload_server_trusted_certificate_file=/etc/ssl/ca/trusted.pem

a_settings=("URL=192.168.50.42" "ServerKeyFile=/etc/ssl/private/journal-upload.pem" \
"ServerCertificateFile=/etc/ssl/certs/journal-upload.pem" "TrustedCertificateFile=/etc/ssl/ca/trusted1.pem")
[ ! -d /etc/systemd/journal-upload.conf.d/ ] && mkdir /etc/systemd/journal-upload.conf.d/
if grep -Psq -- '^\h*\[Upload\]' /etc/systemd/journal-upload.conf.d/60-journald_upload.conf; then
printf '%s\n' "" "${a_settings[@]}" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf
else
printf '%s\n' "" "[Upload]" "${a_settings[@]}" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf
fi
12 changes: 12 additions & 0 deletions ...ide/system/logging/journald/systemd_journal_upload_server_tls/tests/journald-conf.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
#!/bin/bash
# packages = systemd-journal-remote
# variables = var_journal_upload_conf_file=/etc/systemd/journal-upload.conf,var_journal_upload_server_key_file=/etc/ssl/private/journal-upload.pem,var_journal_upload_server_certificate_file=/etc/ssl/certs/journal-upload.pem,var_journal_upload_server_trusted_certificate_file=/etc/ssl/ca/trusted.pem

a_settings=("URL=192.168.50.42" "ServerKeyFile=/etc/ssl/private/journal-upload.pem" \
"ServerCertificateFile=/etc/ssl/certs/journal-upload.pem" "TrustedCertificateFile=/etc/ssl/ca/trusted.pem")
[ ! -f /etc/systemd/journal-upload.conf/ ] && touch /etc/systemd/journal-upload.conf
if grep -Psq -- '^\h*\[Upload\]' /etc/systemd/journal-upload.conf; then
printf '%s\n' "" "${a_settings[@]}" >> /etc/systemd/journal-upload.conf
else
printf '%s\n' "" "[Upload]" "${a_settings[@]}" >> /etc/systemd/journal-upload.conf
fi
6 changes: 4 additions & 2 deletions linux_os/guide/system/logging/journald/systemd_journal_upload_url/bash/shared.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,6 @@
# platform = multi_platform_slmicro
# platform = multi_platform_slmicro,multi_platform_ubuntu

{{{ bash_instantiate_variables("var_journal_upload_conf_file") }}}
{{{ bash_instantiate_variables("var_journal_upload_url") }}}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

See first comment

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wouldn't setting the default in the var_journal_upload_conf_file.var handle the slmicro case?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I compile slmicro5 and it looks like it is ok.

{{{ bash_replace_or_append('/etc/systemd/journal-upload.conf', '^URL', "$var_journal_upload_url", '%s=%s') }}}
{{{ bash_replace_or_append('$var_journal_upload_conf_file', '^URL', "$var_journal_upload_url", '%s=%s') }}}

2 changes: 1 addition & 1 deletion linux_os/guide/system/logging/journald/systemd_journal_upload_url/oval/shared.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
</ind:textfilecontent54_test>

<ind:textfilecontent54_object id="object_test_systemd_journal_upload_url" version="2">
<ind:filepath>/etc/systemd/journal-upload.conf</ind:filepath>
<ind:filepath operation="pattern match">^/etc/systemd/journal-upload.conf(\.d/[^/]+\.conf)?$</ind:filepath>
<ind:pattern operation="pattern match">^\s*URL\s*=\s*(.*)\s*$</ind:pattern>
<ind:instance datatype="int">1</ind:instance>
</ind:textfilecontent54_object>
Expand Down
5 changes: 3 additions & 2 deletions linux_os/guide/system/logging/journald/systemd_journal_upload_url/rule.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,9 +23,10 @@ ocil_clause: 'systemd-journal-upload URL is missing or commented in /etc/systemd

ocil: |-
To ensure logs are sent to a remote host, examine the file
<tt>/etc/systemd/journal-upload.conf</tt>.
<tt>{{{ xccdf_value("var_journal_upload_conf_file") }}}</tt>.
URL should be present:
<pre>URL={{{ xccdf_value("var_journal_upload_url") }}}</pre>

fixtext: |-
Configure systemd-journal-upload URL to {{{ xccdf_value("var_journal_upload_url") }}}
Configure systemd-journal-upload config file to {{{ xccdf_value("var_journal_upload_conf_file") }}}.
Configure systemd-journal-upload URL to {{{ xccdf_value("var_journal_upload_url") }}}
12 changes: 12 additions & 0 deletions ...uide/system/logging/journald/systemd_journal_upload_url/tests/journald-conf-d-url.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
#!/bin/bash
# packages = systemd-journal-remote
# variables = var_journal_upload_conf_file=/etc/systemd/journal-upload.conf.d/60-journald_upload.conf,var_journal_upload_url=192.168.50.42

a_settings=("URL=192.168.50.42" "ServerKeyFile=/etc/ssl/private/journal-upload.pem" \
"ServerCertificateFile=/etc/ssl/certs/journal-upload.pem" "TrustedCertificateFile=/etc/ssl/ca/trusted.pem")
[ ! -d /etc/systemd/journal-upload.conf.d/ ] && mkdir /etc/systemd/journal-upload.conf.d/
if grep -Psq -- '^\h*\[Upload\]' /etc/systemd/journal-upload.conf.d/60-journald_upload.conf; then
printf '%s\n' "" "${a_settings[@]}" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf
else
printf '%s\n' "" "[Upload]" "${a_settings[@]}" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf
fi
12 changes: 12 additions & 0 deletions ...ystem/logging/journald/systemd_journal_upload_url/tests/journald-conf-url-missing.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
#!/bin/bash
# packages = systemd-journal-remote
# variables = var_journal_upload_conf_file=/etc/systemd/journal-upload.conf.d/60-journald_upload.conf,var_journal_upload_url=192.168.50.42

a_settings=("ServerKeyFile=/etc/ssl/private/journal-upload.pem" \
"ServerCertificateFile=/etc/ssl/certs/journal-upload.pem" "TrustedCertificateFile=/etc/ssl/ca/trusted.pem")
[ ! -d /etc/systemd/journal-upload.conf.d/ ] && mkdir /etc/systemd/journal-upload.conf.d/
if grep -Psq -- '^\h*\[Upload\]' /etc/systemd/journal-upload.conf.d/60-journald_upload.conf; then
printf '%s\n' "" "${a_settings[@]}" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf
else
printf '%s\n' "" "[Upload]" "${a_settings[@]}" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf
fi
12 changes: 12 additions & 0 deletions .../guide/system/logging/journald/systemd_journal_upload_url/tests/journald-conf-url.fail.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
#!/bin/bash
# packages = systemd-journal-remote
# variables = var_journal_upload_conf_file=/etc/systemd/journal-upload.conf.d/60-journald_upload.conf,var_journal_upload_url=192.168.50.42

a_settings=("URL=192.168.50.41" "ServerKeyFile=/etc/ssl/private/journal-upload.pem" \
"ServerCertificateFile=/etc/ssl/certs/journal-upload.pem" "TrustedCertificateFile=/etc/ssl/ca/trusted.pem")
[ ! -d /etc/systemd/journal-upload.conf.d/ ] && mkdir /etc/systemd/journal-upload.conf.d/
if grep -Psq -- '^\h*\[Upload\]' /etc/systemd/journal-upload.conf.d/60-journald_upload.conf; then
printf '%s\n' "" "${a_settings[@]}" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf
else
printf '%s\n' "" "[Upload]" "${a_settings[@]}" >> /etc/systemd/journal-upload.conf.d/60-journald_upload.conf
fi
12 changes: 12 additions & 0 deletions .../guide/system/logging/journald/systemd_journal_upload_url/tests/journald-conf-url.pass.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
#!/bin/bash
# packages = systemd-journal-remote
# variables = var_journal_upload_conf_file=/etc/systemd/journal-upload.conf,var_journal_upload_url=192.168.50.42

a_settings=("URL=192.168.50.42" "ServerKeyFile=/etc/ssl/private/journal-upload.pem" \
"ServerCertificateFile=/etc/ssl/certs/journal-upload.pem" "TrustedCertificateFile=/etc/ssl/ca/trusted.pem")
[ ! -f /etc/systemd/journal-upload.conf ] && mkdir /etc/systemd/journal-upload.conf
if grep -Psq -- '^\h*\[Upload\]' /etc/systemd/journal-upload.conf; then
printf '%s\n' "" "${a_settings[@]}" >> /etc/systemd/journal-upload.conf
else
printf '%s\n' "" "[Upload]" "${a_settings[@]}" >> /etc/systemd/journal-upload.conf
fi
14 changes: 14 additions & 0 deletions linux_os/guide/system/logging/journald/var_journal_upload_conf_file.var
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,14 @@
documentation_complete: true

title: 'Remote server for systemd-journal-upload service'

description: |-
The filepath of the journal-upload config file. Options are /etc/systemd/journal-upload.conf or a
file in the /etc/systemd/journal-upload.conf.d directory.

type: string

interactive: true

options:
default: /etc/systemd/journal-upload.conf
2 changes: 1 addition & 1 deletion linux_os/guide/system/logging/journald/var_journal_upload_server_certificate_file.var
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ documentation_complete: true
title: 'Remote server SSL CA certificate in PEM format for systemd-journal-upload service'

description: |-
The setting for ServerCertificateFile in /etc/systemd/journal-upload.conf
The setting for ServerCertificateFile in the journal-upload config file.

type: string

Expand Down
2 changes: 1 addition & 1 deletion linux_os/guide/system/logging/journald/var_journal_upload_server_key_file.var
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ documentation_complete: true
title: 'Remote server SSL key in PEM format for systemd-journal-upload service'

description: |-
The setting for ServerKeyFile in /etc/systemd/journal-upload.conf
The setting for ServerKeyFile in the journal-upload config file.

type: string

Expand Down
2 changes: 1 addition & 1 deletion ...x_os/guide/system/logging/journald/var_journal_upload_server_trusted_certificate_file.var
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ documentation_complete: true
title: 'Remote server SSL CA certificate for systemd-journal-upload service'

description: |-
The setting for TrustedCertificateFile in /etc/systemd/journal-upload.conf
The setting for TrustedCertificateFile in the journal-upload config file.

type: string

Expand Down
2 changes: 1 addition & 1 deletion linux_os/guide/system/logging/journald/var_journal_upload_url.var
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ documentation_complete: true
title: 'Remote server for systemd-journal-upload service'

description: |-
The setting for URL in /etc/systemd/journal-upload.conf
The setting for URL in the journal-upload config file.

type: string

Expand Down
Loading