STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Appliance Photon OS 4.0 Security Technical Implementation Guide Version: 2 Release: 2 Benchmark Date: 01 Jul 2026:

The Photon operating system must configure AIDE to detect changes to baseline configurations.

DISA Rule

SV-266062r1003658_rule

Vulnerability Number

V-266062

Group Title

SRG-OS-000363-GPOS-00150

Rule Version

PHTN-40-000237

Severity

CAT II

CCI(s)

• CCI-001744 - Implement organization-defined security responses automatically if baseline configurations are changed in an unauthorized manner.

Weight

10

Fix Recommendation

Update the /etc/aide.conf file with the template provided as a supplemental document.

At the command line, run the following commands to generate an AIDE database to use for file monitoring:

# aide --init
# cp /var/lib/aide/aide.db.new.gz /var/lib/aide/aide.db.gz

Note: It is recommended to run these fix steps after all other STIG configurations have been completed so that the AIDE database includes those updates.

Check Contents

At the command line, run the following commands to verify AIDE is configured and used to monitor for file changes:

# grep -v '^#' /etc/aide.conf | grep -v '^$'

Example result:

STIG = p+i+n+u+g+s+m+S
LOGS = p+n+u+g
/boot STIG
/opt STIG
/usr STIG
/etc STIG
/var/log LOGS

If the AIDE configuration does not include the lines shown above, this is a finding.

At the command line, run the following commands to verify an AIDE database is configured and used to monitor for file changes:

# aide --check

If the check command indicates there is no database available, this is a finding.

Vulnerability Number

V-266062

Documentable

False

Rule Version

PHTN-40-000237

Severity Override Guidance

At the command line, run the following commands to verify AIDE is configured and used to monitor for file changes:

# grep -v '^#' /etc/aide.conf | grep -v '^$'

Example result:

STIG = p+i+n+u+g+s+m+S
LOGS = p+n+u+g
/boot STIG
/opt STIG
/usr STIG
/etc STIG
/var/log LOGS

If the AIDE configuration does not include the lines shown above, this is a finding.

At the command line, run the following commands to verify an AIDE database is configured and used to monitor for file changes:

# aide --check

If the check command indicates there is no database available, this is a finding.

Check Content Reference

M

Target Key

5569