STIGQter: STIG Summary: Xylok Security Suite 20.x Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 05 Jan 2026:

Xylok Security Suite must use a centralized user management solution.

DISA Rule

SV-269574r1053497_rule

Vulnerability Number

V-269574

Group Title

SRG-APP-000023

Rule Version

XYLK-20-000009

Severity

CAT I

CCI(s)

CCI-000015 - Support the management of system accounts using (organization-defined automated mechanisms).
CCI-000017 - Disable accounts when the accounts have been inactive for the organization-defined time-period.
CCI-000018 - Automatically audit account creation actions.
CCI-001403 - Automatically audit account modification actions.
CCI-001404 - Automatically audit account disabling actions.
CCI-001405 - Automatically audit account removal actions.
CCI-000213 - Enforce approved authorizations for logical access to information and system resources in accordance with applicable access control policies.
CCI-000044 - Enforce the organization-defined limit of consecutive invalid logon attempts by a user during the organization-defined time period.
CCI-000166 - Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.
CCI-000171 - Allow organization-defined personnel or roles to select the event types that are to be logged by specific components of the system.
CCI-000765 - Implement multifactor authentication for network access to privileged accounts.
CCI-000766 - Implement multifactor authentication for network access to non-privileged accounts.
CCI-004045 - Require users to be individually authenticated before granting access to the shared accounts or resources.
CCI-004046 - Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that one of the factors is provided by a device separate from the system gaining access.
CCI-001941 - Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.
CCI-003627 - Disable accounts when the accounts have expired.
CCI-004066 - For password-based authentication, enforce organization-defined composition and complexity rules.
CCI-004061 - For password-based authentication, verify when users create or update passwords, that the passwords are not found on the list of commonly-used, expected, or compromised passwords in IA-5 (1) (a).
CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
CCI-000186 - For public key-based authentication, enforce authorized access to the corresponding private key.
CCI-000187 - For public key-based authentication, map the authenticated identity to the account of the individual or group.
CCI-000804 - Uniquely identify and authenticate non-organizational users or processes acting on behalf of non-organizational users.
CCI-000877 - Employ strong authentication in the establishment of nonlocal maintenance and diagnostic sessions.
CCI-002145 - Enforce organization-defined circumstances and/or usage conditions for organization-defined system accounts.
CCI-002130 - Automatically audit account enabling actions.
CCI-002238 - Automatically lock the account or node for either an organization-defined time period, until the locked account or node is released by an administrator, or delays the next logon prompt according to the organization-defined delay algorithm when the maximum number of unsuccessful logon attempts is exceeded.
CCI-001953 - Accepts Personal Identity Verification-compliant credentials.
CCI-001954 - Electronically verifies Personal Identity Verification-compliant credentials.
CCI-004068 - For public key-based authentication, implement a local cache of revocation data to support path discovery and validation.
CCI-002009 - Accept Personal Identity Verification-compliant credentials from other federal agencies.
CCI-002010 - Electronically verify Personal Identity Verification-compliant credentials from other federal agencies.
CCI-004083 - Accept only external credentials that are NIST compliant.
CCI-004085 - Conform to organization-defined identity management profiles for identity management.
CCI-000172 - Generate audit records for the event types defined in AU-2 c that include the audit record content defined in AU-3.
CCI-003628 - Disable accounts when the accounts are no longer associated to a user.
CCI-003629 - Disable accounts when the accounts are in violation of organizational policy.
CCI-004047 - Implement multi-factor authentication for local; network; and/or remote access to privileged accounts; and/or non-privileged accounts such that the device meets organization-defined strength of mechanism requirements.
CCI-004058 - For password-based authentication, maintain a list of commonly used, expected, or compromised passwords on an organization-defined frequency.
CCI-004059 - For password-based authentication, update the list of passwords on an organization-defined frequency.
CCI-004060 - For password-based authentication, update the list of passwords when organizational passwords are suspected to have been compromised directly or indirectly.
CCI-004062 - For password-based authentication, store passwords using an approved salted key derivation function, preferably using a keyed hash.
CCI-004063 - For password-based authentication, require immediate selection of a new password upon account recovery.
CCI-004064 - For password-based authentication, allow user selection of long passwords and passphrases, including spaces and all printable characters.
CCI-004065 - For password-based authentication, employ automated tools to assist the user in selecting strong password authenticators.
CCI-004909 - Include only approved trust anchors in trust stores or certificate stores managed by the organization.

Weight

Fix Recommendation

The below procedure assumes an AD server hosted on Windows Server. For AD login using Azure AD, refer to the current Xylok Security Suite manual. Additional advice for AD configuration can also be found in the Xylok manual.

Configure the Xylok Security Suite to use Active Directory login using this procedure on the host machine:
1. As root, open /etc/xylok.conf in a text editor.

2. Add the following settings if not present. All settings should be in the format "NAME=value". For example, the first required setting will appear as "AD_SIGN_IN=True" in the configuration file, with no quotes.
- AD_SIGN_IN: use the value "True"
- XYLOK_HOST: set to domain name used to access server on network
- AD_CLIENT_ID: This is the value displayed on the ADFS server as ClientId when executing the Add-AdfsClient command
- AD_SERVER: The fully qualified domain name (FQDN) of the ADFS server
- AD_AUDIENCE: Set this to the value of the aud claim your ADFS server sends back in the JWT token. If this is a URL, it will be the same as the RELYING_PARTY_ID .
- AD_RELYING_PARTY_ID: Set this to the Relying Party Trust identifier value of the Relying Party Trust (2012) or Web application (2016) configured in ADFS.

3. Save the configuration file.

4. Restart Xylok to apply settings:
# systemctl restart xylok

5. In a web browser on a system with access to Xylok, go to https://<your xylok host>/oauth2/login. If SSO is configured correctly, it will redirect to the organization's sign-on page.

Check Contents

Determine if Xylok is configured to use Active Directory (AD) authentication with the following command, run from the host machine as a normal user:

$ grep -e "AD_SIGN_IN" -e "XYLOK_HOST" -e "AD_CLIENT_ID" /etc/xylok.conf

Verify the following settings are present:
- AD_SIGN_IN
- XYLOK_HOST
- AD_CLIENT_ID

If any of the above settings are not present, blank, or "false" (case insensitive), this is a finding.

Vulnerability Number

V-269574

Documentable

False

Rule Version

XYLK-20-000009

Severity Override Guidance

Check Content Reference

Target Key

5665