rsyslog_remote_access_monitoring is misaligned with DISA

[jan-cerny]

Description of problem:

Rule rsyslog_remote_access_monitoring is reported as misaligned with DISA by the /scanning/disa-alignment/oscap on RHEL 10.3. This rule isn't reported as misaligned by /scanning/disa-alignment/ansible

SCAP Security Guide Version:

current upstream master as of 2026-09-22

Operating System Version:

RHEL 10.3

Steps to Reproduce:

1. run /scanning/disa-alignment/oscap

Actual Results:

SSG result: pass, DISA result(s): SV-280990r1165325_rule:fail

Expected Results:

both SSG and DISA passes

Additional Information/Debugging Steps:

DISA's regex seems to be more strict so it doesn't find the authpriv directive in the rsyslog configuration files, whereas our regex can find the authpriv directive there.

[jan-cerny]

In DISA content, the regular expression in oval:mil.disa.stig.ind:obj:25814404 and oval:mil.disa.stig.ind:obj:25814407 -
^[ \t]*(?:\S+;authpriv\.\*|authpriv\.\*;\S+|authpriv\.\*|\S+;authpriv\.\*;\S+)[ \t]+\S+\s*$ - doesn't allow for the "modern" syntax, such as authpriv.* action(type="omfile" file="/var/log/secure"), which is the syntax that our remediation puts to the config file. Only the legacy syntax is allowed by the regular expression, eg. authpriv.* /var/log/secure.