Check: RHEL-06-000285
Red Hat Enterprise Linux 6 STIG:
RHEL-06-000285
(in versions v2 r2 through v1 r26)
Title
The system must have a host-based intrusion detection tool installed. (Cat II impact)
Discussion
Adding host-based intrusion detection tools can provide the capability to automatically take actions in response to malicious behavior, which can provide additional agility in reacting to network threats. These tools also often include a reporting capability to provide network awareness of system, which may not otherwise exist in an organization's systems management regime.
Check Content
Per OPORD 16-0080, the preferred intrusion detection system is McAfee Host Intrusion Prevention System (HIPS) in conjunction with SELinux. McAfee Endpoint Security for Linux (ENSL) is an approved alternative to McAfee Virus Scan Enterprise (VSE) and HIPS. Procedure: Examine the system to see if the Host Intrusion Prevention System (HIPS) is installed: # rpm -qa | grep MFEhiplsm Verify that the McAfee HIPS module is active on the system: # ps -ef | grep -i “hipclient” If the MFEhiplsm package is not installed, check for another intrusion detection system: # find / -name <daemon name> Where <daemon name> is the name of the primary application daemon to determine if the application is loaded on the system. Determine if the application is active on the system: # ps -ef | grep -i <daemon name> If the MFEhiplsm package is not installed and an alternate host-based intrusion detection application has not been documented for use, this is a finding. If no host-based intrusion detection system is installed and running on the system, this is a finding.
Fix Text
Install and enable the latest McAfee HIPS package or McAfee ENSL.
Additional Identifiers
Rule ID: SV-218035r603264_rule
Vulnerability ID: V-218035
Group Title: SRG-OS-000480
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000366 |
The organization implements the security configuration settings. |
| CCI-001263 |
The information system provides near real-time alerts when any of the organization-defined list of compromise or potential compromise indicators occurs. |
| CCI-002664 |
The information system alerts organization-defined personnel or roles when organization-defined compromise indicators reflect the occurrence of a compromise or a potential compromise. |
| CCI-002687 |
The organization implements organization-defined host-based monitoring mechanisms at organization-defined information system components. |