STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 31 Oct 2023:

The Photon operating system must allocate audit record storage capacity to store audit records when audit records are not immediately sent to a central audit record storage facility.

DISA Rule

SV-258844r933593_rule

Vulnerability Number

V-258844

Group Title

SRG-OS-000341-GPOS-00132

Rule Version

PHTN-40-000110

Severity

CAT III

CCI(s)

• CCI-001849 - Allocate audit log storage capacity to accommodate organization-defined audit record retention requirements.

Weight

10

Fix Recommendation

Navigate to and open:

/etc/audit/auditd.conf

Ensure the following lines are present, not duplicated, and not commented:

num_logs = 5
max_log_file_action = ROTATE

At the command line, run the following command:

# pkill -SIGHUP auditd

Check Contents

At the command line, run the following command to verify auditd is configured to keep a number of audit logs in the event of a central log processing failure:

# grep -E "^num_logs|^max_log_file_action" /etc/audit/auditd.conf

Example result:

num_logs = 5
max_log_file_action = ROTATE

If "num_logs" is not configured to "5" or greater, this is a finding.
If "max_log_file_action" is not configured to "ROTATE", this is a finding.

Vulnerability Number

V-258844

Documentable

False

Rule Version

PHTN-40-000110

Severity Override Guidance

At the command line, run the following command to verify auditd is configured to keep a number of audit logs in the event of a central log processing failure:

# grep -E "^num_logs|^max_log_file_action" /etc/audit/auditd.conf

Example result:

num_logs = 5
max_log_file_action = ROTATE

If "num_logs" is not configured to "5" or greater, this is a finding.
If "max_log_file_action" is not configured to "ROTATE", this is a finding.

Check Content Reference

M

Target Key

5569