{"description": "The <tt>rsyslog</tt> daemon should not accept remote messages\nunless the system acts as a log server.\nIf the system needs to act as a central log server, add the following lines to\n<tt>/etc/rsyslog.conf</tt> to enable reception of messages over UDP:\n<pre>$ModLoad imudp\n$UDPServerRun 514</pre>", "rationale": "Many devices, such as switches, routers, and other Unix-like systems, may only support\nthe traditional syslog transmission over UDP. If the system must act as a log server,\nthis enables it to receive their messages as well.", "severity": "unknown", "references": {"cis-csc": ["1", "14", "15", "16", "3", "5", "6"], "cobit5": ["APO11.04", "BAI03.05", "DSS05.04", "DSS05.07", "MEA02.01"], "isa-62443-2009": ["4.3.3.3.9", "4.3.3.5.8", "4.3.4.4.7", "4.4.2.1", "4.4.2.2", "4.4.2.4"], "isa-62443-2013": ["SR 2.10", "SR 2.11", "SR 2.12", "SR 2.8", "SR 2.9"], "iso27001-2013": ["A.12.4.1", "A.12.4.2", "A.12.4.3", "A.12.4.4", "A.12.7.1"], "nerc-cip": ["CIP-004-6 R2.2.2", "CIP-004-6 R3.3", "CIP-007-3 R.1.3", "CIP-007-3 R5", "CIP-007-3 R5.1.1", "CIP-007-3 R6.5"], "nist": ["CM-6(a)", "AU-6(3)", "AU-6(4)"], "nist-csf": ["PR.PT-1"]}, "control_references": {}, "components": [], "identifiers": {}, "ocil_clause": null, "ocil": null, "oval_external_content": null, "fixtext": "", "checktext": "", "vuldiscussion": "", "srg_requirement": "", "warnings": [], "conflicts": [], "requires": [], "policy_specific_content": {}, "platform": null, "platforms": [], "sce_metadata": {}, "inherited_platforms": ["system_with_kernel"], "cpe_platform_names": [], "inherited_cpe_platform_names": ["system_with_kernel"], "bash_conditional": null, "fixes": {}, "title": "Enable rsyslog to Accept Messages via UDP, if Acting As Log Server", "definition_location": "/aptdata/openscap/scap-security-guide/linux_os/guide/system/logging/rsyslog_accepting_remote_messages/rsyslog_accept_remote_messages_udp/rule.yml", "template": null}