Check: PHTN-67-000048
VMware vSphere 6.7 Photon OS STIG:
PHTN-67-000048
(in versions v1 r6 through v1 r1)
Title
The Photon operating system must initiate auditing as part of the boot process. (Cat II impact)
Discussion
Each process on the system carries an "auditable" flag, which indicates whether its activities can be audited. Although auditd takes care of enabling this for all processes that launch after it starts, adding the kernel argument ensures the flag is set at boot for every process on the system. This includes processes created before auditd starts.
Check Content
At the command line, execute the following command: # grep "audit=1" /proc/cmdline If no results are returned, this is a finding.
Fix Text
Open /boot/grub2/grub.cfg with a text editor and locate the boot command line arguments. An example follows: linux "/"$photon_linux root=$rootpartition net.ifnames=0 $photon_cmdline coredump_filter=0x37 consoleblank=0 Add "audit=1" to the end of the line so it reads as follows: linux "/"$photon_linux root=$rootpartition net.ifnames=0 $photon_cmdline coredump_filter=0x37 consoleblank=0 audit=1 Note: Do not copy/paste in this example argument line. This may change in future releases. Find the similar line and append "audit=1" to it. Reboot the system for the change to take effect.
Additional Identifiers
Rule ID: SV-239119r675165_rule
Vulnerability ID: V-239119
Group Title: SRG-OS-000254-GPOS-00095
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001464 |
The information system initiates session audits at system start-up. |
Controls
Number | Title |
---|---|
AU-14 (1) |
System Start-Up |