STIGQter: STIG Summary: Dell OS10 Switch NDM Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 10 Dec 2024:

The Dell OS10 Switch must generate log records for a locally developed list of auditable events.

DISA Rule

SV-269800r1052422_rule

Vulnerability Number

V-269800

Group Title

SRG-APP-000516-NDM-000334

Rule Version

OS10-NDM-000910

Severity

CAT II

CCI(s)

• CCI-000169 - Provide audit record generation capability for the event types the system is capable of auditing as defined in AU-2 a. on organization-defined information system components.
• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

Configure the OS10 Switch to enable audit logging:

OS10(config)# logging audit enable

Configure the switch to log a locally developed list of auditable events by adding appropriate configuration for audit as shown in the example below.

From a shell as root, add desired audit rules to a file in the /etc/audit/rules.d/ directory, as in this example:

OS10# system "sudo -i"
[sudo] password for admin:
root@OS10:~# echo “-w /var/log/sudo.log -p wa -k actions" >> /etc/audit/rules.d/audit.rules
root@OS10:~#

Delete any rules from the rule sets with the obsolete action of “entry”:

root@OS10:~# sed -i '/-a entry/d' /etc/audit/rules.d/*

Reload the rules files:

root@OS10:~# augenrules --load

Check Contents

Determine if the OS10 Switch generates audit log events for a locally developed list of auditable events.

Review the OS10 Switch configuration to determine if audit logging is enabled:

!
logging audit enable

For the locally developed list of audit items review the auditd rule set with the following command:

OS10# system "sudo auditctl -l"
-a never,user
-a never,task
-w /var/run/utmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /usr/bin/dpkg -p x -k software_mgmt
-w /usr/bin/apt-add-repository -p x -k software_mgmt
-w /usr/bin/apt-get -p x -k software_mgmt
-w /usr/bin/aptitude -p x -k software_mgmt
OS10#

If audit logging is not enabled or auditctl does not list rules for the desired auditable events, this is a finding.

Review the OS10 Switch configuration to determine if audit logging is enabled:

!
logging audit enable

If audit logging is not enabled, this is a finding.

Vulnerability Number

V-269800

Documentable

False

Rule Version

OS10-NDM-000910

Severity Override Guidance

Determine if the OS10 Switch generates audit log events for a locally developed list of auditable events.

Review the OS10 Switch configuration to determine if audit logging is enabled:

!
logging audit enable

For the locally developed list of audit items review the auditd rule set with the following command:

OS10# system "sudo auditctl -l"
-a never,user
-a never,task
-w /var/run/utmp -p wa -k session
-w /var/log/btmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /usr/bin/dpkg -p x -k software_mgmt
-w /usr/bin/apt-add-repository -p x -k software_mgmt
-w /usr/bin/apt-get -p x -k software_mgmt
-w /usr/bin/aptitude -p x -k software_mgmt
OS10#

If audit logging is not enabled or auditctl does not list rules for the desired auditable events, this is a finding.

Review the OS10 Switch configuration to determine if audit logging is enabled:

!
logging audit enable

If audit logging is not enabled, this is a finding.

Check Content Reference

M

Target Key

5666