STIGQter: STIG Summary: Solaris 11 X86 Security Technical Implementation Guide Version: 2 Release: 3 Benchmark Date: 23 Apr 2021:

The operating system must employ cryptographic mechanisms to protect information in storage.

DISA Rule

SV-220010r603268_rule

Vulnerability Number

V-220010

Group Title

SRG-OS-000404

Rule Version

SOL-11.1-060150

Severity

CAT III

CCI(s)

• CCI-002475 - The information system implements cryptographic mechanisms to prevent unauthorized modification of organization-defined information at rest on organization-defined information system components.

Weight

10

Fix Recommendation

The ZFS file system management profile is required.

ZFS file system encryption may only be enabled on creation of the file system. If a file system must be encrypted and is not, its data should be archived, it must be removed and re-created.

First, stop running applications using the file systems, archive the data, unmount, and then remove the file system.

# umount [file system name]
# zfs destroy [file system name]

When creating ZFS file systems, ensure that they are created as encrypted file systems.

# pfexec zfs create -o encryption=on [file system name]
Enter passphrase for '[file system name]': xxxxxxx
Enter again: xxxxxxx

Store the passphrase in a safe location. The passphrase will be required to mount the file systems upon system reboot. If automated mounting is required, the passphrase must be stored in a file.

Check Contents

Determine if file system encryption is required by your organization. If not required, this item does not apply.

Determine if file system encryption is enabled for user data sets. This check does not apply to the root, var, share, swap or dump datasets.

# zfs list

Using the file system name, determine if the file system is encrypted:

# zfs get encryption [filesystem]

If "encryption off" is listed, this is a finding.

Vulnerability Number

V-220010

Documentable

False

Rule Version

SOL-11.1-060150

Severity Override Guidance

Determine if file system encryption is required by your organization. If not required, this item does not apply.

Determine if file system encryption is enabled for user data sets. This check does not apply to the root, var, share, swap or dump datasets.

# zfs list

Using the file system name, determine if the file system is encrypted:

# zfs get encryption [filesystem]

If "encryption off" is listed, this is a finding.

Check Content Reference

M

Target Key

4021

Comments