STIGQter: STIG Summary: F5 BIG-IP TMOS NDM Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 02 Jul 2025:

The F5 BIG-IP appliance must be configured to audit the execution of privileged functions such as accounts additions and changes.

DISA Rule

SV-266068r1029557_rule

Vulnerability Number

V-266068

Group Title

SRG-APP-000343-NDM-000289

Rule Version

F5BI-DM-300012

Severity

CAT II

CCI(s)

• CCI-002234 - Log the execution of privileged functions.
• CCI-000018 - Automatically audit account creation actions.
• CCI-001403 - Automatically audit account modification actions.
• CCI-001404 - Automatically audit account disabling actions.
• CCI-001405 - Automatically audit account removal actions.
• CCI-002130 - Automatically audit account enabling actions.
• CCI-000166 - Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
• CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.
• CCI-000366 - Implement the security configuration settings.
• CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.
• CCI-000130 - Ensure that audit records containing information that establishes what type of event occurred.
• CCI-000131 - Ensure that audit records containing information that establishes when the event occurred.
• CCI-000132 - Ensure that audit records containing information that establishes where the event occurred.
• CCI-000133 - Ensure that audit records containing information that establishes the source of the event.
• CCI-000134 - Ensure that audit records containing information that establishes the outcome of the event.
• CCI-001487 - Ensure that audit records containing information that establishes the identity of any individuals, subjects, or objects/entities associated with the event.
• CCI-000135 - Generate audit records containing the organization-defined additional information that is to be included in the audit records.

Weight

10

Fix Recommendation

From the BIG-IP GUI:
1. System.
2. Logs.
3. Configuration.
4. Options.
5. Under "Local Traffic Logging":
a. MCP: Notice.
b. SSL: Informational.
c. Traffic Management OS: Informational.
6. Under "Audit Logging":
a. MCP: Enable.
7. Update.

From the BIG-IP console, type the following commands:

tmsh modify sys daemon-log-settings tmm os-log-level informational
tmsh modify sys daemon-log-settings tmm ssl-log-level informational
tmsh modify sys daemon-log-settings mcpd audit enabled
tmsh modify sys daemon-log-settings mcpd log-level notice
tmsh modify sys db log.ssl.level value informational
tmsh save sys config

Check Contents

From the BIG-IP GUI:
1. System.
2. Logs.
3. Configuration.
4. Options.
5. Under Local Traffic Logging:
a. MCP: Notice.
b. SSL: Informational.
c. Traffic Management OS: Informational.
6. Under Audit Logging:
a. MCP: Enable.

From the BIG-IP console, type the following commands:

tmsh list sys daemon-log-settings tmm os-log-level

Note: This command must return a value of "informational".

tmsh list sys daemon-log-settings tmm ssl-log-level

Note: This must return a value of "informational":

tmsh list sys daemon-log-settings mcpd audit

Note: This must return a value of "enabled".

tmsh list sys daemon-log-settings mcpd log-level

Note: This must return a value of "notice".

tmsh list sys db log.ssl.level value

Note: This must return a value of "informational".

If the BIG-IP appliance is not configured to audit the execution of privileged functions, this is a finding.

Vulnerability Number

V-266068

Documentable

False

Rule Version

F5BI-DM-300012

Severity Override Guidance

From the BIG-IP GUI:
1. System.
2. Logs.
3. Configuration.
4. Options.
5. Under Local Traffic Logging:
a. MCP: Notice.
b. SSL: Informational.
c. Traffic Management OS: Informational.
6. Under Audit Logging:
a. MCP: Enable.

From the BIG-IP console, type the following commands:

tmsh list sys daemon-log-settings tmm os-log-level

Note: This command must return a value of "informational".

tmsh list sys daemon-log-settings tmm ssl-log-level

Note: This must return a value of "informational":

tmsh list sys daemon-log-settings mcpd audit

Note: This must return a value of "enabled".

tmsh list sys daemon-log-settings mcpd log-level

Note: This must return a value of "notice".

tmsh list sys db log.ssl.level value

Note: This must return a value of "informational".

If the BIG-IP appliance is not configured to audit the execution of privileged functions, this is a finding.

Check Content Reference

M

Target Key

5639