Check: GEN006565
SUSE Linux Enterprise Server v11 for System z STIG:
GEN006565
(in versions v1 r12 through v1 r9)
Title
The system package management tool must be used to verify system software periodically. (Cat II impact)
Discussion
Verification using the system package management tool can be used to determine that system software has not been tampered with. This requirement is not applicable to systems not using package management tools.
Check Content
Check the root crontab (crontab -l) and the global crontabs in "/etc/crontab", "/etc/cron.d/*" for the presence of an rpm verification command such as: rpm -qVa | awk '$2!="c" {print $0}' If no such cron job is found, this is a finding. If the result of the cron job indicates packages which do not pass verification exist, this is a finding unless the changes were made due to another STIG entry.
Fix Text
Add a cron job to run an rpm verification command such as: rpm -qVa | awk '$2!="c" {print $0}' For packages which failed verification: If the package is not necessary for operations, remove it from the system. If the package is necessary for operations, re-install the package.
Additional Identifiers
Rule ID: SV-45914r2_rule
Vulnerability ID: V-22506
Group Title: GEN006565
Expert Comments
CCIs
| Number | Definition |
|---|---|
| CCI-000366 |
The organization implements the security configuration settings. |
| CCI-000698 |
The organization requires the developer of the information system, system component, or information system service to enable integrity verification of software and firmware components. |