Install systemd-journal-remote Package
Ensures the systemd-journal-remote package is installed, enabling journald logs to be forwarded to or collected by a remote log host.
Checked against what is installed or registered, packages present/absent, account databases.
A mapping is a cross-reference to where each standard places this requirement, anchored and cross-validated, not a claim of equivalence. A passing check is evidence toward these references, how to read it.
Why this rule matters
systemd-journal-remote provides systemd-journal-upload/systemd-journal-remote, which ship journald logs to a remote collector. Storing log data on a remote host protects log integrity from local attacks: if an attacker gains root on the local system, they can tamper with or delete locally-stored logs to cover their tracks, but a copy already forwarded off-box remains as forensic evidence. Centralized, off-host logging is a baseline requirement for credible incident response.
What Pavois checks
Pavois reads the effective install state from the package database via CINC/InSpec's package resource and asserts systemd-journal-remote is present. The package must be installed before systemd-journal-upload.service can be enabled and configured to forward logs, the package check is the prerequisite for the remote-logging configuration rules.
describe package('systemd-journal-remote') do
it { should be_installed }
endHow to verify it is applied
Run dpkg -s systemd-journal-remote (Debian/Ubuntu) or rpm -q systemd-journal-remote (RHEL/Alma/Fedora); a compliant host returns the installed version. When forwarding is configured, systemctl is-active systemd-journal-upload returns active.
Inspect & investigate
- Installation is logged in
/var/log/dpkg.logor/var/log/dnf.log. - Upload activity and connection state are visible via
journalctl -u systemd-journal-upload.
Remediation
The harden plan declares a package resource for systemd-journal-remote with action install; pavois harden apply installs it via the native package manager. Installing it alone does not start forwarding, you still configure /etc/systemd/journal-upload.conf with a target URL and enable systemd-journal-upload.service.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | install |
|---|---|
| name | systemd-journal-remote |
| resource | package |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Installing the package is safe and adds no listener by default (the upload side only connects outbound; the remote receiver side, if enabled, would open a port, enable only on the dedicated collector). Precaution: configure the upload target and TLS before relying on it, and ensure the remote collector is reachable so logs are not silently queued. No reboot is required.
Standards mapping
| Standard | Reference | Type | Version | Confidence |
|---|---|---|---|---|
| CIS | 6.1.2.1.1, 6.2.2.1.1, 6.2.1.2.1 | direct | per OS, see the benchmark table | high |
Each reference is a cross-reference anchored in the upstream benchmark and cross-validated against the SCAP Security Guide and ansible-lockdown, not a claim of equivalence. Direct = a prescriptive, line-level requirement; supporting = an abstract control family (NIST) the check provides evidence toward. How to read a mapping.