<def-group>
  <definition class="compliance"
  id="rsyslog_remote_access_monitoring" version="1">
    {{{ oval_metadata("Rsyslog should be configured to monitor remote access methods.", rule_title=rule_title) }}}
    <criteria comment="remote access methods are configured in rsyslog" operator="AND">
      <criterion comment="ensure 'auth.*' remote method is configured in rsyslog"
      test_ref="test_remote_method_monitoring_auth" />
      <criterion comment="ensure 'authpriv.*' remote method is configured in rsyslog"
      test_ref="test_remote_method_monitoring_authpriv" />
      <criterion comment="ensure 'daemon.*' remote method is configured in rsyslog"
      test_ref="test_remote_method_monitoring_daemon" />
    </criteria>
  </definition>

  {{% macro test_remote_method(method, test_ref) %}}
  <ind:textfilecontent54_test check="all" check_existence="at_least_one_exists"
  comment="remote method {{{ method }}} monitoring configured in rsyslog'"
  id="test_{{{ test_ref }}}" version="1">
    <ind:object object_ref="obj_{{{ test_ref }}}" />
  </ind:textfilecontent54_test>
  {{% endmacro %}}

  {{{ test_remote_method(method="auth", test_ref="remote_method_monitoring_auth") }}}
  {{{ test_remote_method(method="authpriv", test_ref="remote_method_monitoring_authpriv") }}}
  {{{ test_remote_method(method="daemon", test_ref="remote_method_monitoring_daemon") }}}

  {{% macro object_remote_method(method, test_ref) %}}
  <ind:textfilecontent54_object id="obj_{{{ test_ref }}}" version="1">
    <ind:filepath operation="pattern match">^/etc/rsyslog\.(conf|d/.+\.conf)$</ind:filepath>
    <ind:pattern operation="pattern match">^[ \t]*(?:(?:\w+,)*{{{ method }}}(?:,\w+)*\.\*|\S+;{{{ method }}}\.\*|{{{ method }}}\.\*;\S+|\S+;{{{ method }}}\.\*;\S+)[ \t]+(?:(?!action\()\S+|action\([^)]*file\s*=\s*["'][^"']+["'][^)]*\))\s*$</ind:pattern>
    <ind:instance datatype="int">1</ind:instance>
  </ind:textfilecontent54_object>
  {{% endmacro %}}

  {{{ object_remote_method(method="auth", test_ref="remote_method_monitoring_auth") }}}
  {{{ object_remote_method(method="authpriv", test_ref="remote_method_monitoring_authpriv") }}}
  {{{ object_remote_method(method="daemon", test_ref="remote_method_monitoring_daemon") }}}

</def-group>
