STIGQter: STIG Summary: MarkLogic Server v9 Security Technical Implementation Guide Version: 3 Release: 2 Benchmark Date: 24 Oct 2024:

The audit information produced by MarkLogic Server must be protected from unauthorized deletion.

DISA Rule

SV-220351r960936_rule

Vulnerability Number

V-220351

Group Title

SRG-APP-000120-DB-000061

Rule Version

ML09-00-002100

Severity

CAT II

CCI(s)

• CCI-000164 - Protect audit information from unauthorized deletion.

Weight

10

Fix Recommendation

Apply controls and modify permissions to protect audit log files from unauthorized access at the operating-system level.

Change owner and group of /var/opt/MarkLogic/Logs to user daemon from the command line with a privileged user:
> chown daemon.daemon /var/opt/MarkLogic/Logs

Change permissions of /var/opt/MarkLogic/Logs to 700 (rwx by owner only) from the command line
> chmod 700 /var/opt/MarkLogic/Logs

Check Contents

Review controls and permissions are sufficient to protect audit log files from unauthorized access at the operating-system level.

Verify User ownership, Group ownership, and permissions on the "audit" file:
> ls -al /var/opt/MarkLogic/Logs/AuditLog.txt

If the User owner is not "daemon", this is a finding
If the Group owner is not "daemon", this is a finding.
If the directory is more permissive than 700, this is a finding.

Vulnerability Number

V-220351

Documentable

False

Rule Version

ML09-00-002100

Severity Override Guidance

Review controls and permissions are sufficient to protect audit log files from unauthorized access at the operating-system level.

Verify User ownership, Group ownership, and permissions on the "audit" file:
> ls -al /var/opt/MarkLogic/Logs/AuditLog.txt

If the User owner is not "daemon", this is a finding
If the Group owner is not "daemon", this is a finding.
If the directory is more permissive than 700, this is a finding.

Check Content Reference

M

Target Key

4064