$ sudo ttn-cis-audit /var/tmp/ut0 > /tmp/ut0.out 2>&1; rc=$?; sudo tail -8 /tmp/ut0.out; exit $rc [rc=0] profile: xccdf_ro.tothenoc_profile_cis_server_l1_ttn content: /usr/share/xml/scap/ssg/content/ssg-rl10-ds.xml tailoring: /usr/share/ttn/ttn-tailoring.xml (remote journal upload not configured: those rules are left to the customer (sudo ttn-journal-upload )) W: oscap: Selector ID(xccdf_org.ssgproject.content_rule_systemd_journal_upload_url) does not exist in Benchmark and it will be ignored. 28 notapplicable 294 pass results: /var/tmp/ut0/results.xml report: /var/tmp/ut0/report.html $ sudo python3 -c "import re,sys; t=open(sys.argv[1]).read(); print([m for m in re.findall(r'idref=\"xccdf_org.ssgproject.content_rule_([^\"]+)\"[^>]*>\s*(?:fail|error|unknown)', t)])" /var/tmp/ut0/results.xml [rc=0] [] $ sudo mkdir -p /var/tmp/jr; SEL=; [ "$(getenforce 2>/dev/null)" = Enforcing ] && SEL="-p SELinuxContext=unconfined_u:unconfined_r:unconfined_t:s0"; sudo systemd-run --unit=ttn-jr-test $SEL /usr/lib/systemd/systemd-journal-remote --listen-http=127.0.0.1:19532 --output=/var/tmp/jr/; sleep 3; sudo ss -ltnp | grep 19532 [rc=0] LISTEN 0 4096 127.0.0.1:19532 0.0.0.0:* users:(("systemd-journal",pid=7123,fd=6)) Running as unit: ttn-jr-test.service; invocation ID: f33f997f84b94504b613f2d754a65c51 $ sudo ttn-journal-upload http://127.0.0.1:19532 [rc=0] journal upload: on -> http://127.0.0.1:19532 $ logger ttn-upload-test-1793743722; sleep 10; sudo journalctl -D /var/tmp/jr --no-pager 2>/dev/null | grep -c ttn-upload-test-1793743722 [rc=0] 1 $ systemctl is-active systemd-journal-upload; systemctl is-enabled systemd-journal-upload; grep -n URL /etc/systemd/journal-upload.conf; sudo grep -n 'set-value\|journal' /usr/share/ttn/ttn-tailoring*-upload.xml [rc=0] active enabled 2:URL=http://127.0.0.1:19532 7: TTN: CIS Level 1 Server (remote journal upload configured) $ sudo ttn-cis-audit /var/tmp/ut1 > /tmp/ut1.out 2>&1; rc=$?; sudo tail -8 /tmp/ut1.out; exit $rc [rc=0] profile: xccdf_ro.tothenoc_profile_cis_server_l1_ttn content: /usr/share/xml/scap/ssg/content/ssg-rl10-ds.xml tailoring: /usr/share/ttn/ttn-tailoring-upload.xml (remote journal upload configured: those rules are checked) 28 notapplicable 295 pass results: /var/tmp/ut1/results.xml report: /var/tmp/ut1/report.html $ sudo python3 -c "import re,sys; t=open(sys.argv[1]).read(); print([m for m in re.findall(r'idref=\"xccdf_org.ssgproject.content_rule_([^\"]+)\"[^>]*>\s*(?:fail|error|unknown)', t)])" /var/tmp/ut1/results.xml [rc=0] [] $ sudo find / -xdev \( -nouser -o -nogroup \) -ls 2>/dev/null | head -20; systemctl show -p User -p Group -p DynamicUser -p StateDirectory systemd-journal-upload systemd-journal-remote 2>/dev/null; getent passwd systemd-journal-upload systemd-journal-remote [rc=0] User=systemd-journal-upload Group= DynamicUser=no StateDirectory=systemd/journal-upload User=systemd-journal-remote Group= DynamicUser=no StateDirectory= systemd-journal-upload:x:992:992::/:/usr/sbin/nologin systemd-journal-remote:x:993:993:systemd Journal Remote:/:/usr/sbin/nologin $ sudo grep -o 'content_rule_[a-z_-]*journal[a-z_-]*\"[^>]*>[[:space:]]*[a-z]*' /var/tmp/ut1/results.xml | sed 's/\".*/ = /' | sort -u [rc=0] grep: warning: stray \ before " $ systemctl is-system-running; systemctl --failed --no-legend [rc=0] running $ sudo systemctl stop ttn-jr-test; sudo rm -rf /var/tmp/jr [rc=0] $ sudo ttn-journal-upload --off; systemctl is-enabled systemd-journal-upload; ls /usr/share/ttn/ [rc=0] journal upload: off disabled ttn-audit.env ttn-tailoring.xml Removed '/etc/systemd/system/multi-user.target.wants/systemd-journal-upload.service'. REZUMAT {"tailoring_saved": true, "audit_default_rc": 0, "helper_rc": 0, "mesaj_in_colector": "1", "audit_upload_rc": 0, "fails_upload": "[]", "system": "running", "off": "journal upload: off\ndisabled\nttn-audit.env\nttn-tailoring.xml\nRemoved '/etc/systemd/system/multi-user.target.wants/systemd-journal-upload.service'."}