STIGQter: STIG Summary: VMware vSphere 6.7 Photon OS Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 09 Mar 2021:

The Photon operating system must audit the execution of privileged functions.

DISA Rule

SV-239127r675189_rule

Vulnerability Number

V-239127

Group Title

SRG-OS-000327-GPOS-00127

Rule Version

PHTN-67-000056

Severity

CAT II

CCI(s)

• CCI-000172 - The information system generates audit records for the events defined in AU-2 d. with the content defined in AU-3.
• CCI-002234 - The information system audits the execution of privileged functions.

Weight

10

Fix Recommendation

At the command line, execute the following command to obtain a list of setuid files:

# find / -xdev -perm -4000 -type f -o -perm -2000 -type f

Execute the following command for each setuid file found in the first command that does not have a corresponding line in the audit rules:

# echo '-a always,exit -F path=<setuid_path> -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged' >> /etc/audit/rules.d/audit.STIG.rules

Replace <setuid_path> with each path found in the first command.

Execute the following command to load the new rules:

# /sbin/augenrules --load

Check Contents

At the command line, execute the following command to obtain a list of setuid files:

# find / -xdev -perm -4000 -type f -o -perm -2000 -type f

Execute the following command for each setuid file found in the first command:

# grep <setuid_path> /etc/audit/audit.rules

Replace <setuid_path> with each path found in the first command.

If each <setuid_path> does not have a corresponding line in the audit rules, this is a finding.

A typical corresponding line will look like the following:

-a always,exit -F path=<setuid_path> -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

Vulnerability Number

V-239127

Documentable

False

Rule Version

PHTN-67-000056

Severity Override Guidance

At the command line, execute the following command to obtain a list of setuid files:

# find / -xdev -perm -4000 -type f -o -perm -2000 -type f

Execute the following command for each setuid file found in the first command:

# grep <setuid_path> /etc/audit/audit.rules

Replace <setuid_path> with each path found in the first command.

If each <setuid_path> does not have a corresponding line in the audit rules, this is a finding.

A typical corresponding line will look like the following:

-a always,exit -F path=<setuid_path> -F perm=x -F auid>=1000 -F auid!=4294967295 -k privileged

Check Content Reference

M

Target Key

5323

Comments