STIGQter: STIG Summary: Xylok Security Suite 20.x Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:

Xylok Security Suite must prevent access except through HTTPS.

DISA Rule

SV-269573r1054093_rule

Vulnerability Number

V-269573

Group Title

SRG-APP-000014

Rule Version

XYLK-20-000006

Severity

CAT I

CCI(s)

• CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.
• CCI-000382 - Configure the system to prohibit or restrict the use of organization-defined prohibited or restricted functions, system ports, protocols, software, and/or services.
• CCI-001184 - Protect the authenticity of communications sessions.
• CCI-002890 - Implement organization-defined cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications.
• CCI-003123 - Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.
• CCI-002418 - Protect the confidentiality and/or integrity of transmitted information.
• CCI-002421 - Implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission.
• CCI-002422 - Maintain the confidentiality and/or integrity of information during reception.
• CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.

Weight

10

Fix Recommendation

Add/Amend HTTP_ONLY to the configuration files:
1. As root, open /etc/xylok.conf in a text editor.

2. Add/Amend the following to the configuration file:
HTTP_ONLY=false

3. Restart Xylok to apply settings by executing the following:
# systemctl restart xylok

Check Contents

Verify HTTP_ONLY is set to "false":
$ grep HTTP_ONLY
/etc/xylok.conf HTTP_ONLY=false

If "HTTP_ONLY=true" or is not configured, this is a finding.

Vulnerability Number

V-269573

Documentable

False

Rule Version

XYLK-20-000006

Severity Override Guidance

Verify HTTP_ONLY is set to "false":
$ grep HTTP_ONLY
/etc/xylok.conf HTTP_ONLY=false

If "HTTP_ONLY=true" or is not configured, this is a finding.

Check Content Reference

M

Target Key

5665