STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 31 Oct 2023:

The Photon operating system must configure auditd to log to disk.

DISA Rule

SV-258807r933482_rule

Vulnerability Number

V-258807

Group Title

SRG-OS-000037-GPOS-00015

Rule Version

PHTN-40-000014

Severity

CAT II

CCI(s)

• CCI-000130 - Ensure that audit records containing information that establishes what type of event occurred.

Weight

10

Fix Recommendation

Navigate to and open:

/etc/audit/auditd.conf

Ensure the "write_logs" line is uncommented and set to the following:

write_logs = yes

At the command line, run the following command:

# pkill -SIGHUP auditd

Check Contents

At the command line, run the following command to verify auditd is configured to write logs to disk:

# grep '^write_logs' /etc/audit/auditd.conf

Example result:

write_logs = yes

If there is no output, this is not a finding.

If "write_logs" exists and is not configured to "yes", this is a finding.

Vulnerability Number

V-258807

Documentable

False

Rule Version

PHTN-40-000014

Severity Override Guidance

At the command line, run the following command to verify auditd is configured to write logs to disk:

# grep '^write_logs' /etc/audit/auditd.conf

Example result:

write_logs = yes

If there is no output, this is not a finding.

If "write_logs" exists and is not configured to "yes", this is a finding.

Check Content Reference

M

Target Key

5569