STIGQter: STIG Summary: VMware vRealize Automation 7.x SLES Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Sep 2018:

The SLES for vRealize audit system must be configured to audit user deletions of files and programs.

DISA Rule

SV-100499r1_rule

Vulnerability Number

V-89849

Group Title

SRG-OS-000474-GPOS-00219

Rule Version

VRAU-SL-001460

Severity

CAT II

CCI(s)

• CCI-000172 - The information system generates audit records for the events defined in AU-2 d. with the content defined in AU-3.

Weight

10

Fix Recommendation

Edit the audit.rules file and add the following line(s) to enable auditing of deletions of files and programs:

-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid=0
-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295
-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid=0
-a always,exit -F arch=b32 -S unlink -S unlinkat -S rename -S renameat -F auid>=500 -F auid!=4294967295

Check Contents

To determine if the system is configured to audit calls to the "unlink" system call, run the following command:

# auditctl -l | grep syscall | grep unlink | grep -v unlinkat

If the system is configured to audit this activity, it will return several lines.

If it does not, this is a finding.

To determine if the system is configured to audit calls to the "unlinkat" system call, run the following command:

# auditctl -l | grep syscall | grep unlinkat

If the system is configured to audit this activity, it will return several lines.

If it does not, this is a finding.

To determine if the system is configured to audit calls to the "rename" system call, run the following command:

# auditctl -l | grep syscall | grep rename | grep -v renameat

If the system is configured to audit this activity, it will return several lines.

If it does not, this is a finding.

To determine if the system is configured to audit calls to the "renameat" system call, run the following command:

# auditctl -l | grep syscall | grep renameat

If the system is configured to audit this activity, it will return several lines.

If it does not, this is a finding.

Vulnerability Number

V-89849

Documentable

False

Rule Version

VRAU-SL-001460

Severity Override Guidance

To determine if the system is configured to audit calls to the "unlink" system call, run the following command:

# auditctl -l | grep syscall | grep unlink | grep -v unlinkat

If the system is configured to audit this activity, it will return several lines.

If it does not, this is a finding.

To determine if the system is configured to audit calls to the "unlinkat" system call, run the following command:

# auditctl -l | grep syscall | grep unlinkat

If the system is configured to audit this activity, it will return several lines.

If it does not, this is a finding.

To determine if the system is configured to audit calls to the "rename" system call, run the following command:

# auditctl -l | grep syscall | grep rename | grep -v renameat

If the system is configured to audit this activity, it will return several lines.

If it does not, this is a finding.

To determine if the system is configured to audit calls to the "renameat" system call, run the following command:

# auditctl -l | grep syscall | grep renameat

If the system is configured to audit this activity, it will return several lines.

If it does not, this is a finding.

Check Content Reference

M

Target Key

3459

Comments