CIS Graylog Benchmark

This recommendation verifies that Graylog is running the latest stable version on the Graylog log management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Graylog log management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Graylog version
curl -s http://localhost:9000/api/system | python3 -m json.tool | grep version
dpkg -l graylog-server 2>/dev/null || rpm -qi graylog-server 2>/dev/null

# Update Graylog
apt-get update && apt-get install -y graylog-server
# or
yum update graylog-server
systemctl restart graylog-server

This recommendation verifies that essential configuration settings are applied on the Graylog log management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Graylog log management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Graylog configuration
grep -E 'root_timezone|is_leader|http_bind' /etc/graylog/server/server.conf | head -10

# Configure essential settings
# In /etc/graylog/server/server.conf:
is_leader = true
root_timezone = UTC
bin_dir = /usr/share/graylog-server/bin
data_dir = /var/lib/graylog-server
plugin_dir = /usr/share/graylog-server/plugin

This recommendation verifies that root password and password secret are strong on the Graylog log management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Graylog log management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check root user password hash
grep 'root_password_sha2' /etc/graylog/server/server.conf

# Set strong root password
echo -n 'StrongP@ssw0rd!' | sha256sum | cut -d' ' -f1
# In /etc/graylog/server/server.conf:
root_password_sha2 = <sha256_hash>
# Set password secret (min 16 chars):
pwgen -N 1 -s 96
password_secret = <generated_secret>

This recommendation verifies that external authentication and session limits are configured on the Graylog log management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Graylog log management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check authentication backend
grep -E 'auth_providers|ldap' /etc/graylog/server/server.conf

# Configure LDAP/AD authentication
# Via Graylog API or Web UI:
# System > Authentication > Create LDAP backend
# Set LDAP URI, bind DN, search base
# Map LDAP groups to Graylog roles
# Enforce session timeout:
# In server.conf:
user_session_timeout = 30m
allow_highlighting = true

This recommendation verifies that HTTPS is enabled for the web interface and API on the Graylog log management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Graylog log management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check HTTPS configuration
grep -E 'http_enable_tls|http_tls' /etc/graylog/server/server.conf

# Enable HTTPS
# In /etc/graylog/server/server.conf:
http_enable_tls = true
http_tls_cert_file = /etc/graylog/certs/graylog.crt
http_tls_key_file = /etc/graylog/certs/graylog.key
http_tls_key_password = <key_password>
# Store password in environment variable instead

This recommendation verifies that TLS is configured for Elasticsearch connection on the Graylog log management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Graylog log management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Elasticsearch connection
grep 'elasticsearch_hosts' /etc/graylog/server/server.conf

# Configure TLS for Elasticsearch
# In /etc/graylog/server/server.conf:
elasticsearch_hosts = https://es-node1:9200,https://es-node2:9200
# For certificate verification:
elasticsearch_disable_version_check = false
# Place CA cert in Java truststore:
keytool -importcert -keystore /usr/lib/jvm/java-17/lib/security/cacerts \
  -file /etc/graylog/certs/ca.crt -alias graylog-ca -storepass changeit

This recommendation verifies that server log rotation is configured on the Graylog log management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Graylog log management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Graylog server log
ls -la /var/log/graylog-server/
tail -20 /var/log/graylog-server/server.log

# Configure logging
# In /etc/graylog/server/log4j2.xml:
# Set root logger level to INFO
# Add file appender with rotation:
# <RollingFile name="rolling-file"
#   fileName="/var/log/graylog-server/server.log"
#   filePattern="/var/log/graylog-server/server-%d{yyyy-MM-dd}.log.gz">
#   <PatternLayout pattern="%d{ISO8601} %-5p [%c{1}] %m%n"/>
#   <Policies>
#     <TimeBasedTriggeringPolicy/>
#     <SizeBasedTriggeringPolicy size="100MB"/>
#   </Policies>
#   <DefaultRolloverStrategy max="30"/>

This recommendation verifies that audit logging and access logs are enabled on the Graylog log management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Graylog log management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check audit log via Graylog
curl -su admin:pass http://localhost:9000/api/system/audit 2>&1 | head -5

# Enable audit logging
# Graylog Enterprise: Enable via System > Audit Log
# Open Source: Use access logs
# In /etc/graylog/server/server.conf:
access_log_enabled = true
# Monitor via internal Graylog index
# Create alerts for admin actions

This recommendation verifies that the web interface is bound to localhost or behind a proxy on the Graylog log management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Graylog log management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check binding addresses
grep -E 'http_bind_address|http_publish_uri' /etc/graylog/server/server.conf
ss -tlnp | grep -E '9000|12900'

# Restrict binding
# In /etc/graylog/server/server.conf:
http_bind_address = 127.0.0.1:9000
http_publish_uri = https://graylog.example.com:9000/
http_external_uri = https://graylog.example.com:9000/
# Use reverse proxy for external access

This recommendation verifies that log inputs use TLS and are bound to internal interfaces on the Graylog log management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Graylog log management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check input configurations
curl -su admin:pass http://localhost:9000/api/system/inputs | python3 -m json.tool | grep -E 'title|port'

# Secure syslog/GELF inputs
# Use TLS-enabled inputs (GELF TCP with TLS, Syslog TCP with TLS)
# Bind to internal interfaces only:
# Input config: bind_address = 10.0.1.5
# Configure firewall:
ufw allow from 10.0.0.0/8 to any port 12201 proto tcp
ufw allow from 10.0.0.0/8 to any port 1514 proto tcp

This setting ensures that configuration file permissions are restricted on the Graylog log management platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Graylog log management platform is essential for defense in depth.

# Check config permissions
stat -c '%a %U %G' /etc/graylog/server/server.conf
find /etc/graylog -type f -exec stat -c '%a %U %G %n' {} \;

# Restrict configuration
chown root:graylog /etc/graylog/server/server.conf
chmod 640 /etc/graylog/server/server.conf
chmod 700 /etc/graylog/certs
chmod 600 /etc/graylog/certs/*.key

This setting ensures that data directory permissions are restricted on the Graylog log management platform. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Graylog log management platform is essential for defense in depth.

# Check data directory
stat -c '%a %U %G' /var/lib/graylog-server
find /var/lib/graylog-server -maxdepth 1 -exec stat -c '%a %n' {} \;

# Restrict data directory
chown -R graylog:graylog /var/lib/graylog-server
chmod 750 /var/lib/graylog-server
chmod 750 /var/log/graylog-server

This recommendation verifies that JVM settings are hardened on the Graylog log management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Graylog log management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check JVM settings
cat /etc/default/graylog-server | grep GRAYLOG_SERVER_JAVA_OPTS
cat /etc/graylog/server/jvm.options 2>/dev/null

# Harden JVM settings
# In /etc/default/graylog-server:
GRAYLOG_SERVER_JAVA_OPTS="-Xms2g -Xmx2g -XX:+UseG1GC -Dlog4j2.formatMsgNoLookups=true"
# Do NOT expose JMX remotely

This recommendation verifies that unused plugins and content packs are removed on the Graylog log management platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the Graylog log management platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check content packs and plugins
ls /usr/share/graylog-server/plugin/
curl -su admin:pass http://localhost:9000/api/system/content_packs | python3 -m json.tool | grep name | head -10

# Review and remove unused plugins
# Remove unused plugin JARs from /usr/share/graylog-server/plugin/
# Audit installed content packs via API
# Restrict plugin installation to authorized personnel