STIGQter: STIG Summary: IBM MQ Appliance v9.0 NDM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 05 Jun 2017:

The MQ Appliance network device must protect against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.

DISA Rule

SV-89609r1_rule

Vulnerability Number

V-74935

Group Title

SRG-APP-000080-NDM-000220

Rule Version

MQMH-ND-000210

Severity

CAT II

CCI(s)

• CCI-000130 - The information system generates audit records containing information that establishes what type of event occurred.
• CCI-000132 - The information system generates audit records containing information that establishes where the event occurred.
• CCI-000133 - The information system generates audit records containing information that establishes the source of the event.
• CCI-000166 - The information system protects against an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
• CCI-001487 - The information system generates audit records containing information that establishes the identity of any individuals or subjects associated with the event.
• CCI-002130 - The information system automatically audits account enabling actions.

Weight

10

Fix Recommendation

Log on to the MQ Appliance CLI as a privileged user.

Configure a syslog target.

To enter global configuration mode, enter "config".

To create a syslog target, enter:

logging target <logging target name>
type syslog
admin-state enabled
local-address <MQ Appliance IP>
remote-address <syslog server IP>
remote-port <syslog server port>
event audit info
event auth notice
event mgmt notice
event cli notice
event user notice
event system error
exit
write mem
y

Check Contents

Log on to the MQ Appliance CLI as a privileged user.

Enter:
co
show logging target

All configured logging targets will be displayed. Verify:
- This list includes a remote syslog notification target; and
- It includes all of the following log event source and log level parameters:
event audit info
event auth notice
event mgmt notice
event cli notice
event user notice
event system error

If these events are not configured, this is a finding.

Vulnerability Number

V-74935

Documentable

False

Rule Version

MQMH-ND-000210

Severity Override Guidance

Log on to the MQ Appliance CLI as a privileged user.

Enter:
co
show logging target

All configured logging targets will be displayed. Verify:
- This list includes a remote syslog notification target; and
- It includes all of the following log event source and log level parameters:
event audit info
event auth notice
event mgmt notice
event cli notice
event user notice
event system error

If these events are not configured, this is a finding.

Check Content Reference

M

Target Key

3243

Comments