Addresses "<OS> must be configured to forward audit records via TCP to a different system or media from the system being audited via rsyslog" finding

[ferricoxide]

If the ash-linux:lookup:rsyslog:collector_host Pillar value is set, this automation will attempt to configure the rsyslog service to forward all logged activity to the host declared via the ash-linux:lookup:rsyslog:collector_host Pillar value.

Closes #555

[ferricoxide]

Testing output:

Content executes on Red Hat and Oracle Enterprise Linux, Alma and Rocky Linux and CentOS Stream 9. Testing-outup from Alma Linux 9 shown.

Pillar-Value not declared:

----------
          ID: ALMA-09-053040-description
    Function: test.show_notification
      Result: True
     Comment: ----------------------------------------
              STIG Finding ID: ALMA-09-053040
                  The OS must be configured to forward
                  audit records via TCP to a different
                  system or media from the system
                  being audited via rsyslog
              ----------------------------------------
     Started: 16:34:31.118517
    Duration: 0.796 ms
     Changes:
----------
          ID: No Collector Specified (ALMA-09-053040)
    Function: test.show_notification
      Result: True
     Comment: No syslog collector hostname/IP found in Pillar-data
     Started: 16:34:31.119452
    Duration: 0.524 ms
     Changes:
----------
          ID: Re-read rsyslog configuration-options (ALMA-09-053040)
    Function: service.running
        Name: rsyslog.service
      Result: True
     Comment: The service rsyslog.service is already running
     Started: 16:34:31.135215
    Duration: 2023.537 ms
     Changes:
------------

Pillar-Value declared:

Value not set anywhere (/etc/rsyslog.conf or /etc/rsyslog.d/*.conf):

----------
          ID: ALMA-09-053040-description
    Function: test.show_notification
      Result: True
     Comment: ----------------------------------------
              STIG Finding ID: ALMA-09-053040
                  The OS must be configured to forward
                  audit records via TCP to a different
                  system or media from the system
                  being audited via rsyslog
              ----------------------------------------
     Started: 15:14:17.780931
    Duration: 0.898 ms
     Changes:
----------
          ID: Set log-destination in /etc/rsyslog.conf to syslog.lab via TCP (ALMA-09-053040)
    Function: file.replace
        Name: /etc/rsyslog.conf
      Result: True
     Comment: Changes were made
     Started: 15:14:17.782004
    Duration: 5.868 ms
     Changes:
              ----------
              diff:
                  ---
                  +++
                  @@ -88,3 +88,4 @@
                   # Set per rule ALMA-09-052710
                   $ActionSendStreamDriverMode 1

                  +# Set per rule ALMA-09-053040
                  *.* @@syslog.lab
----------
          ID: Re-read rsyslog configuration-options (ALMA-09-053040)
    Function: service.running
        Name: rsyslog.service
      Result: True
     Comment: Service restarted
     Started: 15:14:17.697575
    Duration: 852.21 ms
     Changes:
              ----------
              rsyslog.service:
                  True
------------

Value Set — Overriding existing forwarding via TCP:

----------
          ID: ALMA-09-053040-description
    Function: test.show_notification
      Result: True
     Comment: ----------------------------------------
              STIG Finding ID: ALMA-09-053040
                  The OS must be configured to forward
                  audit records via TCP to a different
                  system or media from the system
                  being audited via rsyslog
              ----------------------------------------
     Started: 16:13:29.351035
    Duration: 0.739 ms
     Changes:
----------
          ID: Set log-destination in /etc/rsyslog.conf to syslog.lab via TCP (ALMA-09-053040)
    Function: file.replace
        Name: /etc/rsyslog.conf
      Result: True
     Comment: Changes were made
     Started: 16:13:29.354279
    Duration: 19.083 ms
     Changes:
              ----------
              diff:
                  ---
                  +++
                  @@ -88,4 +88,4 @@
                   # Set per rule ALMA-09-052710
                   $ActionSendStreamDriverMode 1

                  -*.* @@syslog1.lab
                  +*.* @@syslog.lab
----------
          ID: Re-read rsyslog configuration-options (ALMA-09-053040)
    Function: service.running
        Name: rsyslog.service
      Result: True
     Comment: Service restarted
     Started: 16:13:29.697575
    Duration: 852.21 ms
     Changes:
              ----------
              rsyslog.service:
                  True
------------

Value Set — Overriding forwarding via UDP:

----------
          ID: ALMA-09-053040-description
    Function: test.show_notification
      Result: True
     Comment: ----------------------------------------
              STIG Finding ID: ALMA-09-053040
                  The OS must be configured to forward
                  audit records via TCP to a different
                  system or media from the system
                  being audited via rsyslog
              ----------------------------------------
     Started: 16:16:43.055175
    Duration: 0.724 ms
     Changes:
----------
          ID: Set log-destination in /etc/rsyslog.d/log_offload.conf to syslog.lab via TCP (ALMA-09-053040)
    Function: file.replace
        Name: /etc/rsyslog.d/log_offload.conf
      Result: True
     Comment: Changes were made
     Started: 16:16:43.057705
    Duration: 11.714 ms
     Changes:
              ----------
              diff:
                  ---
                  +++
                  @@ -1 +1 @@
                  -*.* @syslog.lab
                  +*.* @@syslog.lab
----------
          ID: Re-read rsyslog configuration-options (ALMA-09-053040)
    Function: service.running
        Name: rsyslog.service
      Result: True
     Comment: Service restarted
     Started: 16:16:43.697575
    Duration: 852.21 ms
     Changes:
              ----------
              rsyslog.service:
                  True
------------

Value Set — Overriding forwarding via RELP:

----------
          ID: ALMA-09-053040-description
    Function: test.show_notification
      Result: True
     Comment: ----------------------------------------
              STIG Finding ID: ALMA-09-053040
                  The OS must be configured to forward
                  audit records via TCP to a different
                  system or media from the system
                  being audited via rsyslog
              ----------------------------------------
     Started: 16:29:08.656310
    Duration: 0.73 ms
     Changes:
----------
          ID: Set log-destination in /etc/rsyslog.d/log_offload.conf to syslog.lab via TCP (ALMA-09-053040)
    Function: file.replace
        Name: /etc/rsyslog.d/log_offload.conf
      Result: True
     Comment: Changes were made
     Started: 16:29:08.658637
    Duration: 11.615 ms
     Changes:
              ----------
              diff:
                  ---
                  +++
                  @@ -1 +1 @@
                  -*.* :omrelp:syslog.lab:3514
                  +*.* @@syslog.lab
----------
          ID: Re-read rsyslog configuration-options (ALMA-09-053040)
    Function: service.running
        Name: rsyslog.service
      Result: True
     Comment: Service restarted
     Started: 16:29:08.697575
    Duration: 852.21 ms
     Changes:
              ----------
              rsyslog.service:
                  True
------------

Valid value already set:

----------
          ID: ALMA-09-053040-description
    Function: test.show_notification
      Result: True
     Comment: ----------------------------------------
              STIG Finding ID: ALMA-09-053040
                  The OS must be configured to forward
                  audit records via TCP to a different
                  system or media from the system
                  being audited via rsyslog
              ----------------------------------------
     Started: 16:21:29.118384
    Duration: 0.758 ms
     Changes:
----------
          ID: Set log-destination in /etc/rsyslog.d/log_offload.conf to syslog.lab via TCP (ALMA-09-053040)
    Function: file.replace
        Name: /etc/rsyslog.d/log_offload.conf
      Result: True
     Comment: No changes needed to be made
     Started: 16:21:29.120873
    Duration: 7.729 ms
     Changes:
------------
          ID: Re-read rsyslog configuration-options (ALMA-09-053040)
    Function: service.running
        Name: rsyslog.service
      Result: True
     Comment: The service rsyslog.service is already running
     Started: 16:21:29.616971
    Duration: 1941.668 ms
     Changes:
------------