STIGQter: STIG Summary: Solaris 11 X86 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The operating system must protect the confidentiality and integrity of information at rest.

DISA Rule

SV-216176r603268_rule

Vulnerability Number

V-216176

Group Title

SRG-OS-000185

Rule Version

SOL-11.1-060160

Severity

CAT III

CCI(s)

• CCI-001199 - The information system protects the confidentiality and/or integrity of organization-defined information at rest.

Weight

10

Fix Recommendation

The ZFS file system management profile is required.

ZFS file system encryption may only be enabled on creation of the file system. If a file system must be encrypted and is not, its data should be archived, it must be removed and re-created.

First, stop running applications using the file systems, archive the data, unmount, and then remove the file system.

# umount [file system name]
# zfs destroy [file system name]

When creating ZFS file systems, ensure that they are created as encrypted file systems.

# pfexec zfs create -o encryption=on [file system name]
Enter passphrase for '[file system name]': xxxxxxx
Enter again: xxxxxxx

Store the passphrase in a safe location. The passphrase will be required to mount the file systems upon system reboot. If automated mounting is required, the passphrase must be stored in a file.

Check Contents

Determine if file system encryption is required by your organization. If not required, this item does not apply.

Determine if file system encryption is enabled for user data sets. This check does not apply to the root, var, share, swap or dump datasets.

# zfs list

Using the file system name, determine if the file system is encrypted:

# zfs get encryption [filesystem]

If "encryption off" is listed, this is a finding.

Vulnerability Number

V-216176

Documentable

False

Rule Version

SOL-11.1-060160

Severity Override Guidance

Determine if file system encryption is required by your organization. If not required, this item does not apply.

Determine if file system encryption is enabled for user data sets. This check does not apply to the root, var, share, swap or dump datasets.

# zfs list

Using the file system name, determine if the file system is encrypted:

# zfs get encryption [filesystem]

If "encryption off" is listed, this is a finding.

Check Content Reference

M

Target Key

4021

Comments