STIGQter: STIG Summary: HYCU Protege Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 01 Jul 2026:

The HYCU virtual appliance must automatically audit account removal actions.

DISA Rule

SV-268234r1038654_rule

Vulnerability Number

V-268234

Group Title

SRG-APP-000029-NDM-000211

Rule Version

HYCU-ND-000160

Severity

CAT II

CCI(s)

• CCI-001405 - Automatically audit account removal actions.

Weight

10

Fix Recommendation

Log in to the HYCU VM console and load the STIG audit rules by using the following commands:

1. cp /usr/share/audit/sample-rules/10-base-config.rules /usr/share/audit/sample-rules/30-stig.rules /usr/share/audit/sample-rules/31-privileged.rules /usr/share/audit/sample-rules/99-finalize.rules /etc/audit/rules.d/

2. augenrules --load

Check Contents

Verify the operating system generates audit records for all account removal events.

Check the auditing rules in "/etc/audit/audit.rules" with the following command:
# grep -E "/etc/passwd|/etc/gshadow|/etc/shadow|/etc/security/opasswd|/etc/group|/etc/sudoers|/etc/sudoers.d/" /etc/audit/audit.rules

-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/sudoers -p wa -k identity
-w /etc/sudoers.d/ -p wa -k identity

If the command does not return all the lines above, or one or more of the lines are commented out, this is a finding.

Vulnerability Number

V-268234

Documentable

False

Rule Version

HYCU-ND-000160

Severity Override Guidance

Verify the operating system generates audit records for all account removal events.

Check the auditing rules in "/etc/audit/audit.rules" with the following command:
# grep -E "/etc/passwd|/etc/gshadow|/etc/shadow|/etc/security/opasswd|/etc/group|/etc/sudoers|/etc/sudoers.d/" /etc/audit/audit.rules

-w /etc/passwd -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/security/opasswd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/sudoers -p wa -k identity
-w /etc/sudoers.d/ -p wa -k identity

If the command does not return all the lines above, or one or more of the lines are commented out, this is a finding.

Check Content Reference

M

Target Key

5660