STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 31 Oct 2023:

The Photon operating system must initiate session audits at system startup.

DISA Rule

SV-258836r933569_rule

Vulnerability Number

V-258836

Group Title

SRG-OS-000254-GPOS-00095

Rule Version

PHTN-40-000080

Severity

CAT II

CCI(s)

CCI-001464 - Initiates session audits automatically at system start-up.

Weight

Fix Recommendation

Navigate to and open:

/boot/grub2/grub.cfg

Locate the boot command line arguments. An example follows:

linux /boot/$photon_linux root=$rootpartition $photon_cmdline $systemd_cmdline

Add "audit=1" to the end of the line so it reads as follows:

linux /boot/$photon_linux root=$rootpartition $photon_cmdline $systemd_cmdline audit=1

Note: Do not copy/paste in this example argument line. This may change in future releases. Find the similar line and append "audit=1" to it.

Reboot the system for the change to take effect.

Check Contents

At the command line, run the following command to verify auditing is enabled at startup:

# grep 'audit' /proc/cmdline

Example result:

BOOT_IMAGE=/boot/vmlinuz-5.10.109-2.ph4-esx root=PARTUUID=6e6293c6-9ab6-49e9-aa97-9b212f2e037a init=/lib/systemd/systemd rcupdate.rcu_expedited=1 rw systemd.show_status=1 quiet noreplace-smp cpu_init_udelay=0 plymouth.enable=0 systemd.legacy_systemd_cgroup_controller=yes audit=1

If the "audit" parameter is not present with a value of "1", this is a finding.

Vulnerability Number

V-258836

Documentable

False

Rule Version

PHTN-40-000080

Severity Override Guidance

Check Content Reference

Target Key

5569