STIGQter: STIG Summary: MarkLogic Server v9 Security Technical Implementation Guide Version: 3 Release: 2 Benchmark Date: 24 Oct 2024:

The audit information produced by MarkLogic Server must be protected from unauthorized read access.

DISA Rule

SV-220349r960930_rule

Vulnerability Number

V-220349

Group Title

SRG-APP-000118-DB-000059

Rule Version

ML09-00-001900

Severity

CAT II

CCI(s)

• CCI-000162 - Protect audit information from unauthorized access.

Weight

10

Fix Recommendation

Apply controls and modify permissions to protect audit log files from unauthorized access at the operating-system level.

Change owner and group of /var/opt/MarkLogic/Logs to user daemon from the command line with a privileged user:
> chown daemon.daemon /var/opt/MarkLogic/Logs

Change permissions of /var/opt/MarkLogic/Logs to 700 (rwx by owner only) from the command line
> chmod 700 /var/opt/MarkLogic/Logs

Check Contents

Review controls and permissions are sufficient to protect audit log files from unauthorized access at the operating-system level.

Verify User ownership, Group ownership, and permissions on the "audit" file:
> ls -al /var/opt/MarkLogic/Logs/AuditLog.txt

If the User owner is not "daemon", this is a finding
If the Group owner is not "daemon", this is a finding.
If the directory is more permissive than 700, this is a finding.

Vulnerability Number

V-220349

Documentable

False

Rule Version

ML09-00-001900

Severity Override Guidance

Review controls and permissions are sufficient to protect audit log files from unauthorized access at the operating-system level.

Verify User ownership, Group ownership, and permissions on the "audit" file:
> ls -al /var/opt/MarkLogic/Logs/AuditLog.txt

If the User owner is not "daemon", this is a finding
If the Group owner is not "daemon", this is a finding.
If the directory is more permissive than 700, this is a finding.

Check Content Reference

M

Target Key

4064