$ sudo ttn-cis-audit /var/tmp/ut0 > /tmp/ut0.out 2>&1; rc=$?; sudo tail -8 /tmp/ut0.out; exit $rc [rc=0] WARNING: Datastream component 'scap_org.open-scap_cref_security-oval-oval-definitions-trixie.xml.bz2' points out to the remote 'https://www.debian.org/security/oval/oval-definitions-trixie.xml.bz2'. Use '--fetch-remote-resources' option to download it. WARNING: Skipping 'https://www.debian.org/security/oval/oval-definitions-trixie.xml.bz2' file which is referenced from datastream WARNING: Skipping ./security-oval-oval-definitions-trixie.xml.bz2 file which is referenced from XCCDF content W: oscap: Entity name 'value' from state (id: 'oval:ssg-state_accounts_password_last_change_is_in_past_time_diff:ste:1') not found in item (id: '103135262'). 33 notapplicable 1 notchecked 358 pass results: /var/tmp/ut0/results.xml report: /var/tmp/ut0/report.html $ sudo python3 -c "import re,sys; t=open(sys.argv[1]).read(); print([m for m in re.findall(r'idref=\"xccdf_org.ssgproject.content_rule_([^\"]+)\"[^>]*>\s*(?:fail|error|unknown)', t)])" /var/tmp/ut0/results.xml [rc=0] [] $ sudo mkdir -p /var/tmp/jr; SEL=; [ "$(getenforce 2>/dev/null)" = Enforcing ] && SEL="-p SELinuxContext=unconfined_u:unconfined_r:unconfined_t:s0"; sudo systemd-run --unit=ttn-jr-test $SEL /usr/lib/systemd/systemd-journal-remote --listen-http=127.0.0.1:19532 --output=/var/tmp/jr/; sleep 3; sudo ss -ltnp | grep 19532 [rc=0] LISTEN 0 4096 127.0.0.1:19532 0.0.0.0:* users:(("systemd-journal",pid=4258,fd=6)) Running as unit: ttn-jr-test.service; invocation ID: 0f4e9d8fc2d540ae9e35a43f9a9eb2b5 $ sudo ttn-journal-upload http://127.0.0.1:19532 [rc=0] journal upload: on -> http://127.0.0.1:19532 $ logger ttn-upload-test-1793660297; sleep 10; sudo journalctl -D /var/tmp/jr --no-pager 2>/dev/null | grep -c ttn-upload-test-1793660297 [rc=0] 1 $ systemctl is-active systemd-journal-upload; systemctl is-enabled systemd-journal-upload; grep -n URL /etc/systemd/journal-upload.conf; sudo grep -n 'set-value\|journal' /usr/share/ttn/ttn-tailoring*-upload.xml [rc=0] active enabled 20:URL=http://127.0.0.1:19532 3: The upstream profile selects mutually exclusive CIS alternatives at once (chrony enabled AND disabled, journald forwarding AND not forwarding to syslog). 4: TTN choice: time = chrony (Amazon Time Sync 169.254.169.123), logs = persistent journald only (as on the EL images). 6: v2: remote journal upload targets the CUSTOMER's log collector -> deselected; the package stays installed, the service disabled 7: (enable with: sudo ttn-journal-upload ). Reasons on the evidence page. --> 12: TTN: CIS Debian Benchmark Level 1 Server (chrony + journald; remote journal upload configured) 17: 22: http://127.0.0.1:19532 23: /etc/pki/systemd/private/journal-upload.pem 24: /etc/pki/systemd/certs/journal-upload.pem 25: /etc/pki/systemd/ca/trusted.pem $ sudo ttn-cis-audit /var/tmp/ut1 > /tmp/ut1.out 2>&1; rc=$?; sudo tail -8 /tmp/ut1.out; exit $rc [rc=0] WARNING: Datastream component 'scap_org.open-scap_cref_security-oval-oval-definitions-trixie.xml.bz2' points out to the remote 'https://www.debian.org/security/oval/oval-definitions-trixie.xml.bz2'. Use '--fetch-remote-resources' option to download it. WARNING: Skipping 'https://www.debian.org/security/oval/oval-definitions-trixie.xml.bz2' file which is referenced from datastream WARNING: Skipping ./security-oval-oval-definitions-trixie.xml.bz2 file which is referenced from XCCDF content W: oscap: Entity name 'value' from state (id: 'oval:ssg-state_accounts_password_last_change_is_in_past_time_diff:ste:1') not found in item (id: '104359262'). 33 notapplicable 1 notchecked 360 pass results: /var/tmp/ut1/results.xml report: /var/tmp/ut1/report.html $ sudo python3 -c "import re,sys; t=open(sys.argv[1]).read(); print([m for m in re.findall(r'idref=\"xccdf_org.ssgproject.content_rule_([^\"]+)\"[^>]*>\s*(?:fail|error|unknown)', t)])" /var/tmp/ut1/results.xml [rc=0] [] $ sudo find / -xdev $ -nouser -o -nogroup $ -ls 2>/dev/null | head -20; systemctl show -p User -p Group -p DynamicUser -p StateDirectory systemd-journal-upload systemd-journal-remote 2>/dev/null; getent passwd systemd-journal-upload systemd-journal-remote [rc=0] User=systemd-journal-upload Group= DynamicUser=no StateDirectory=systemd/journal-upload User=systemd-journal-remote Group= DynamicUser=no StateDirectory= systemd-journal-upload:x:999:989::/:/usr/sbin/nologin systemd-journal-remote:x:986:986:systemd Journal Remote:/:/usr/sbin/nologin $ sudo grep -o 'content_rule_[a-z_-]*journal[a-z_-]*\"[^>]*>[[:space:]]*[a-z]*' /var/tmp/ut1/results.xml | sed 's/\".*/ = /' | sort -u [rc=0] $ systemctl is-system-running; systemctl --failed --no-legend [rc=0] running $ sudo systemctl stop ttn-jr-test; sudo rm -rf /var/tmp/jr [rc=0] $ sudo ttn-journal-upload --off; systemctl is-enabled systemd-journal-upload; ls /usr/share/ttn/ [rc=0] journal upload: off disabled ssg-debian13-ds.xml ttn-audit.env ttn-tailoring-debian13.xml Removed '/etc/systemd/system/multi-user.target.wants/systemd-journal-upload.service'. REZUMAT {"tailoring_saved": true, "audit_default_rc": 0, "helper_rc": 0, "mesaj_in_colector": "1", "audit_upload_rc": 0, "fails_upload": "[]", "system": "running", "off": "journal upload: off\ndisabled\nssg-debian13-ds.xml\nttn-audit.env\nttn-tailoring-debian13.xml\nRemoved '/etc/systemd/system/multi-user.target.wants/systemd-journal-upload.service'."}