STIGQter: STIG Summary: McAfee VSEL 1.9/2.0 Local Client Security Technical Implementation Guide Version: 1 Release: 6 Benchmark Date: 24 Apr 2020:

The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Demand scanner must be configured to Move infected files to the quarantine directory if first action fails when a virus or Trojan is detected.

DISA Rule

SV-77613r1_rule

Vulnerability Number

V-63123

Group Title

SRG-APP-000277

Rule Version

DTAVSEL-107

Severity

CAT II

CCI(s)

• CCI-001241 - The organization configures malicious code protection mechanisms to perform periodic scans of the information system on an organization-defined frequency.

Weight

10

Fix Recommendation

From a desktop browser window, connect to the McAfee VirusScan Enterprise for Linux (VSEL) Monitor (WEB interface) of the Linux system being reviewed and logon with the nails user account.

In the VSEL WEB Monitor, review tasks under "View", "Scheduled Tasks".
With the System Administrator's assistance, determine which task is intended as the regularly scheduled scan task.
Click on the task, and then click "Modify".
Under "2. What to Scan", click "Next".
Under "3. Choose Scan Settings", Anti-virus Actions", select "Quarantine" from the second dropdown list "Actions for Viruses and Trojans" if first action fails, click "Next", and then click "Finish".

Check Contents

From a desktop browser window, connect to the McAfee VirusScan Enterprise for Linux (VSEL) Monitor (WEB interface) of the Linux system being reviewed and logon with the nails user account.

In the VSEL WEB Monitor, review tasks under "View", "Scheduled Tasks".
With the System Administrator's assistance, determine which task is intended as the regularly scheduled scan task.
Click on the task, and then click "Modify".
Under "2. What to Scan", click "Next".
Under "3. Choose Scan Settings", "Anti-virus Actions", verify "Quarantine" is selected in the second dropdown list "Actions for Viruses and Trojans" if first action fails.

If "Quarantine" is not selected in the second dropdown list "Actions for Viruses and Trojans" if first action fails, this is a finding.

To validate without the Web interface, access the Linux system being reviewed, either at the console or by a SSH connection.
At the command line, navigate to /var/opt/NAI/LinuxShield/etc.
Enter the command "grep "ODS.action.App.secondary" ods.cfg"

If the response given for "nailsd.profile.ODS.action.App.secondary" is not "Quarantine", this is a finding.

Vulnerability Number

V-63123

Documentable

False

Rule Version

DTAVSEL-107

Severity Override Guidance

From a desktop browser window, connect to the McAfee VirusScan Enterprise for Linux (VSEL) Monitor (WEB interface) of the Linux system being reviewed and logon with the nails user account.

In the VSEL WEB Monitor, review tasks under "View", "Scheduled Tasks".
With the System Administrator's assistance, determine which task is intended as the regularly scheduled scan task.
Click on the task, and then click "Modify".
Under "2. What to Scan", click "Next".
Under "3. Choose Scan Settings", "Anti-virus Actions", verify "Quarantine" is selected in the second dropdown list "Actions for Viruses and Trojans" if first action fails.

If "Quarantine" is not selected in the second dropdown list "Actions for Viruses and Trojans" if first action fails, this is a finding.

To validate without the Web interface, access the Linux system being reviewed, either at the console or by a SSH connection.
At the command line, navigate to /var/opt/NAI/LinuxShield/etc.
Enter the command "grep "ODS.action.App.secondary" ods.cfg"

If the response given for "nailsd.profile.ODS.action.App.secondary" is not "Quarantine", this is a finding.

Check Content Reference

M

Target Key

2941

Comments