CIS Logstash Benchmark

This recommendation verifies that Logstash is running the latest stable version on the Logstash data processing pipeline. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Logstash data processing pipeline vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Logstash version
/usr/share/logstash/bin/logstash --version
dpkg -l logstash 2>/dev/null || rpm -qi logstash 2>/dev/null

# Update to latest stable
apt-get update && apt-get install -y logstash
# or
yum update logstash

This recommendation verifies that Logstash runs as a dedicated non-root user on the Logstash data processing pipeline. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Logstash data processing pipeline vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Logstash service user
ps -eo user,pid,args | grep logstash | grep -v grep
grep '^logstash' /etc/passwd

# Run Logstash as dedicated non-root user
useradd -r -s /usr/sbin/nologin logstash 2>/dev/null
chown -R logstash:logstash /etc/logstash /var/log/logstash /var/lib/logstash
# In /etc/systemd/system/logstash.service:
# User=logstash
# Group=logstash

This recommendation verifies that API authentication is enabled on the Logstash data processing pipeline. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Logstash data processing pipeline vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check API authentication
curl -s http://localhost:9600/ | python3 -m json.tool
grep 'api.auth' /etc/logstash/logstash.yml

# Enable API authentication
# In /etc/logstash/logstash.yml:
api.auth.type: basic
api.auth.basic.username: logstash_admin
api.auth.basic.password: "${LOGSTASH_API_PASSWORD}"
api.auth.basic.password_policy.mode: WARN
# Restart:
systemctl restart logstash

This recommendation verifies that credentials are managed via the Logstash keystore on the Logstash data processing pipeline. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Logstash data processing pipeline vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check pipeline configuration for credentials
grep -rn 'password\|api_key\|secret' /etc/logstash/conf.d/ | head -10

# Use Logstash keystore for secrets
/usr/share/logstash/bin/logstash-keystore create
/usr/share/logstash/bin/logstash-keystore add ES_PASSWORD
# Reference in pipeline config:
# output {
#   elasticsearch {
#     password => "${ES_PASSWORD}"
#   }
# }
# Never store plain-text credentials in pipeline configs

This recommendation verifies that TLS is enabled on Beats/TCP inputs on the Logstash data processing pipeline. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Logstash data processing pipeline vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check SSL/TLS on Beats input
grep -A10 'beats' /etc/logstash/conf.d/*.conf | grep -i 'ssl'

# Enable TLS on Beats input
# In pipeline config:
input {
  beats {
    port => 5044
    ssl_enabled => true
    ssl_certificate => "/etc/logstash/certs/logstash.crt"
    ssl_key => "/etc/logstash/certs/logstash.key"
    ssl_certificate_authorities => ["/etc/logstash/certs/ca.crt"]
    ssl_client_authentication => "required"
  }
}

This recommendation verifies that TLS is enabled on Elasticsearch output on the Logstash data processing pipeline. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Logstash data processing pipeline vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check Elasticsearch output TLS
grep -A10 'elasticsearch' /etc/logstash/conf.d/*.conf | grep -i 'ssl\|https'

# Enable TLS on Elasticsearch output
output {
  elasticsearch {
    hosts => ["https://es-node1:9200"]
    ssl_enabled => true
    ssl_certificate_authorities => ["/etc/logstash/certs/ca.crt"]
    ssl_certificate => "/etc/logstash/certs/logstash.crt"
    ssl_key => "/etc/logstash/certs/logstash.key"
    ssl_verification_mode => "full"
  }
}

This recommendation verifies that logging level and slowlog are configured on the Logstash data processing pipeline. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Logstash data processing pipeline vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check logging configuration
grep 'log.level\|log.format\|path.logs' /etc/logstash/logstash.yml
ls -la /var/log/logstash/

# Configure logging
# In /etc/logstash/logstash.yml:
log.level: info
log.format: json
path.logs: /var/log/logstash
slowlog.threshold.warn: 2s
slowlog.threshold.info: 1s
slowlog.threshold.debug: 500ms

This recommendation verifies that log rotation is configured on the Logstash data processing pipeline. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Logstash data processing pipeline vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check log rotation
ls -la /var/log/logstash/logstash-plain*.log* 2>/dev/null
cat /etc/logrotate.d/logstash 2>/dev/null

# Configure log rotation
cat > /etc/logrotate.d/logstash << 'EOF'
/var/log/logstash/*.log {
    daily
    rotate 30
    compress
    delaycompress
    missingok
    notifempty
    copytruncate
}
EOF

This recommendation verifies that the monitoring API is bound to localhost on the Logstash data processing pipeline. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Logstash data processing pipeline vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check API binding
grep 'api.http.host\|api.http.port' /etc/logstash/logstash.yml
ss -tlnp | grep 9600

# Restrict API binding
# In /etc/logstash/logstash.yml:
api.http.host: 127.0.0.1
api.http.port: 9600
api.ssl.enabled: true
api.ssl.keystore.path: /etc/logstash/certs/api-keystore.p12
api.ssl.keystore.password: "${API_KEYSTORE_PASSWORD}"

This recommendation verifies that pipeline inputs are bound to specific interfaces on the Logstash data processing pipeline. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Logstash data processing pipeline vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check pipeline input bindings
grep -rn 'host\|port' /etc/logstash/conf.d/*.conf | head -10
ss -tlnp | grep -E '5044|514'

# Restrict input bindings
# Bind to specific interfaces:
input {
  beats {
    host => "10.0.1.5"
    port => 5044
  }
}
# Use firewall rules:
ufw allow from 10.0.0.0/8 to any port 5044 proto tcp

This setting ensures that configuration file permissions are restricted on the Logstash data processing pipeline. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Logstash data processing pipeline is essential for defense in depth.

# Check config file permissions
stat -c '%a %U %G' /etc/logstash/logstash.yml
find /etc/logstash -type f -exec stat -c '%a %U %G %n' {} \;

# Restrict configuration permissions
chown -R root:logstash /etc/logstash
chmod 750 /etc/logstash
chmod 640 /etc/logstash/logstash.yml
chmod 640 /etc/logstash/conf.d/*.conf
chmod 600 /etc/logstash/logstash.keystore

This setting ensures that data directory permissions are restricted on the Logstash data processing pipeline. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted access to this capability could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the Logstash data processing pipeline is essential for defense in depth.

# Check data directory
stat -c '%a %U %G' /var/lib/logstash
find /var/lib/logstash -maxdepth 1 -exec stat -c '%a %n' {} \;

# Restrict data directory
chown -R logstash:logstash /var/lib/logstash
chmod 750 /var/lib/logstash
chmod 750 /var/log/logstash

This recommendation verifies that persistent queue and resource limits are configured on the Logstash data processing pipeline. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Logstash data processing pipeline vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check pipeline workers and queue
grep -E 'pipeline.workers|queue.type|queue.max_bytes' /etc/logstash/logstash.yml

# Configure resource limits and persistent queue
# In /etc/logstash/logstash.yml:
pipeline.workers: 2
pipeline.batch.size: 125
queue.type: persisted
queue.max_bytes: 1gb
queue.checkpoint.writes: 1024

This recommendation verifies that JVM security settings are hardened on the Logstash data processing pipeline. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the Logstash data processing pipeline vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check JVM settings
cat /etc/logstash/jvm.options | grep -v '^#' | grep -v '^$'

# Configure JVM security settings
# In /etc/logstash/jvm.options:
-Xms1g
-Xmx1g
-Dlog4j2.formatMsgNoLookups=true
-Djava.security.policy=/etc/logstash/security.policy
# Disable remote JMX:
# Do NOT set com.sun.management.jmxremote