Check: OL6-00-000285
Oracle Linux 6 STIG:
OL6-00-000285
(in versions v2 r7 through v2 r4)
Title
The Oracle Linux operating system must implement the Endpoint Security for Linux Threat Prevention tool. (Cat II impact)
Discussion
Adding endpoint security tools can provide the capability to automatically take actions in response to malicious behavior, which can provide additional agility in reacting to network threats. These tools also often include a reporting capability to provide network awareness of system, which may not otherwise exist in an organization's systems management regime.
Check Content
Per OPORD 16-0080, the preferred endpoint security tool is McAfee Endpoint Security for Linux (ENSL) in conjunction with SELinux. Procedure: Check that the following package has been installed: # rpm -qa | grep -i mcafeetp If the "mcafeetp" package is not installed, this is a finding. Verify that the daemon is running: # ps -ef | grep -i mfetpd If the daemon is not running, this is a finding.
Fix Text
Install and enable the latest McAfee ENSLTP package.
Additional Identifiers
Rule ID: SV-219568r793825_rule
Vulnerability ID: V-219568
Group Title: SRG-OS-000191
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001233 |
The organization employs automated mechanisms on an organization-defined frequency to determine the state of information system components with regard to flaw remediation. |
Controls
Number | Title |
---|---|
SI-2 (2) |
Automated Flaw Remediation Status |