Check: GEN000000-SOL00180
Solaris 10 X86 STIG:
GEN000000-SOL00180
(in versions v2 r4 through v1 r17)
Title
The Solaris system Automated Security Enhancement Tool (ASET) configurable parameters in the asetenv file must be correct. (Cat II impact)
Discussion
If settings in the asetenv file have been modified, then system vulnerabilities may not be detected.
Check Content
Determine if ASET is being used. # crontab -l | grep aset Check the configuration of ASET. # more /usr/aset/asetenv OR Check that asetenv has not been modified since installation. # pkgchk SUNWast If there are any changes below the following two lines that are not comments, this is a finding. # Don't change from here on down ... # # there shouldn't be any reason to. # In addition, if any of the following lines do not match, this is a finding. TASKS="firewall env sysconf usrgrp tune cklist eeprom" CKLISTPATH_LOW=${ASETDIR}/tasks:#${ASETDIR} \ /util:${ASETDIR}/masters:/etc CKLISTPATH_MED=${CKLISTPATH_LOW}:/usr/bin:/usr/ucb CKLISTPATH_HIGH=${CKLISTPATH_MED}:/usr/lib:/sbin: \ /usr/sbin:/usr/ucblib YPCHECK=false PERIODIC_SCHEDULE="0 0 * * *" UID_ALIASES=${ASETDIR}/masters/uid_aliases (The default asetenv file can be found on the Solaris installation media.)
Fix Text
Restore the ASET configuration to vendor default and only modify the portions of the configuration designated as customizable.
Additional Identifiers
Rule ID: SV-227540r603266_rule
Vulnerability ID: V-227540
Group Title: SRG-OS-000016
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000032 |
Enforce information flow control using organization-defined security policy filters as a basis for flow control decisions for organization-defined information flows. |
| CCI-000366 |
Implement the security configuration settings. |