STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 01 Jul 2026:

The Photon operating system must protect audit tools from unauthorized access.

DISA Rule

SV-258837r991557_rule

Vulnerability Number

V-258837

Group Title

SRG-OS-000256-GPOS-00097

Rule Version

PHTN-40-000082

Severity

CAT II

CCI(s)

CCI-001493 - Protect audit tools from unauthorized access.
CCI-001494 - Protect audit tools from unauthorized modification.
CCI-001495 - Protect audit tools from unauthorized deletion.

Weight

Fix Recommendation

At the command line, run the following commands for each file returned:

# chown root:root <file>
# chmod 750 <file>

Note: Update permissions to match the target file as listed in the check text.

Check Contents

At the command line, run the following command to verify permissions on audit tools:

# stat -c "%n is owned by %U and group owned by %G and permissions are %a" /usr/sbin/audispd /usr/sbin/auditctl /usr/sbin/auditd /usr/sbin/aureport /usr/sbin/ausearch /usr/sbin/autrace /usr/sbin/augenrules

Expected result:

/usr/sbin/audispd is owned by root and group owned by root and permissions are 750
/usr/sbin/auditctl is owned by root and group owned by root and permissions are 755
/usr/sbin/auditd is owned by root and group owned by root and permissions are 755
/usr/sbin/aureport is owned by root and group owned by root and permissions are 755
/usr/sbin/ausearch is owned by root and group owned by root and permissions are 755
/usr/sbin/autrace is owned by root and group owned by root and permissions are 755
/usr/sbin/augenrules is owned by root and group owned by root and permissions are 750

If any file is not owned by root or group owned by root or permissions are more permissive than listed above, this is a finding.

Vulnerability Number

V-258837

Documentable

False

Rule Version

PHTN-40-000082

Severity Override Guidance

Check Content Reference

Target Key

5569