Repository navigation
rsyslog_remote_access_monitoring is misaligned with DISA #15134
Description
Description of problem:
Rule rsyslog_remote_access_monitoring is reported as misaligned with DISA by the /scanning/disa-alignment/oscap on RHEL 10.3. This rule isn't reported as misaligned by /scanning/disa-alignment/ansible
SCAP Security Guide Version:
current upstream master as of 2026-09-22
Operating System Version:
RHEL 10.3
Steps to Reproduce:
- run
/scanning/disa-alignment/oscap
Actual Results:
SSG result: pass, DISA result(s): SV-280990r1165325_rule:fail
Expected Results:
both SSG and DISA passes
Additional Information/Debugging Steps:
DISA's regex seems to be more strict so it doesn't find the authpriv directive in the rsyslog configuration files, whereas our regex can find the authpriv directive there.
Activity
Report misalignments with RHEL 10 DISA content
jan-cerny commentedon Sep 23, 2026
In DISA content, the regular expression in
oval:mil.disa.stig.ind:obj:25814404andoval:mil.disa.stig.ind:obj:25814407-^[ \t]*(?:\S+;authpriv\.\*|authpriv\.\*;\S+|authpriv\.\*|\S+;authpriv\.\*;\S+)[ \t]+\S+\s*$- doesn't allow for the "modern" syntax, such asauthpriv.* action(type="omfile" file="/var/log/secure"), which is the syntax that our remediation puts to the config file. Only the legacy syntax is allowed by the regular expression, eg.authpriv.* /var/log/secure.