2.1 Collect system configuration regularly

Information

Maintain a listing of the system configuration showing assets configured into the system.

Rationale:

The syslog facility local1 is chosen as this is also the facility that the Dynamic Resource Manager (DRM) reports to. The command logger simplifies appending command stdout to the syslogd.

Impact:

All changes to the system configuration should be logged so that the expected configuration is documented. Regular verification of the current configuration makes it possible to identify and correct undocumented system configuration changes.

Solution

This example shows how to setup a daily cronjob. The actual frequency you use might differ. The keyword in the recommendation is: regular.

This example also shows two syslog reporting lines: one to a system file, the second to a centralized syslog service.

The syslog facility local1 is used to keep these reports out of the standard syslog facilities. There is not meant to establish a requirement to use facility local1.

# mkdir -p /var/log/syslog
# touch /var/log/syslog/inventory.log
# print 'local1.info /var/log/syslog/inventory.log rotate 1m files 24 compress' >> /etc/syslog.conf
# print 'local1.info @rsyslog.domain' >> /etc/syslog.conf
# refresh -s syslogd || startsrc -s syslogd

# print '0 0 * * * /usr/sbin/lsconf -v | /usr/bin/logger -p local1.info -t Inventory' >> /var/spool/crontabs/root
# /usr/sbin/lsconf -v | /usr/bin/logger -p local1.info -t Inventory

See Also

https://workbench.cisecurity.org/benchmarks/13069

Item Details

Category: CONFIGURATION MANAGEMENT, PROGRAM MANAGEMENT

References: 800-53|CM-8, 800-53|CM-8(1), 800-53|PM-5, CSCv7|1.4

Plugin: Unix

Control ID: a5055aaef437f457b686f84397ac79dcb1f646385519cbe02a6ff4325ff8609b