STIGQter STIGQter: STIG Summary: VMware vSphere 7.0 vCenter Appliance Photon OS Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 30 Jan 2025:

The Photon operating system must initiate auditing as part of the boot process.

DISA Rule

SV-256521r991555_rule

Vulnerability Number

V-256521

Group Title

SRG-OS-000254-GPOS-00095

Rule Version

PHTN-30-000046

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Navigate to and open:

/boot/grub2/grub.cfg

Locate the boot command line arguments. An example follows:

linux /$photon_linux root=$rootpartition $photon_cmdline $systemd_cmdline

Add "audit=1" to the end of the line so it reads as follows:

linux /$photon_linux root=$rootpartition $photon_cmdline $systemd_cmdline audit=1

Note: Do not copy/paste in this example argument line. This may change in future releases. Find the similar line and append "audit=1" to it.

Reboot the system for the change to take effect.

Check Contents

At the command line, run the following command:

# grep "audit=1" /proc/cmdline

If no results are returned, this is a finding.

Vulnerability Number

V-256521

Documentable

False

Rule Version

PHTN-30-000046

Severity Override Guidance

At the command line, run the following command:

# grep "audit=1" /proc/cmdline

If no results are returned, this is a finding.

Check Content Reference

M

Target Key

5520