STIGQter: STIG Summary: HP FlexFabric Switch NDM Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Jul 2020:

The HP FlexFabric Switch must record time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).

DISA Rule

SV-80743r1_rule

Vulnerability Number

V-66253

Group Title

SRG-APP-000374-NDM-000299

Rule Version

HFFS-ND-000101

Severity

CAT II

CCI(s)

• CCI-001890 - The information system records time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).

Weight

10

Fix Recommendation

Configure time zone on the HP FlexFabric Switch:

[HP] clock timezone EST minus 5:00:00

Configure timestamp on the logs on the HP FlexFabric Switch:

[HP] info-center timestamp date

Note: By default, the device uses internal system clocks to generate time stamps for audit records in the date format - MMM DD hh:mm:ss:xxx YYYY.

Check Contents

Determine if time zone is configured on the HP FlexFabric Switch:

[HP] display clock

15:00:32 EST Thu 07/09/2015
Time Zone : EST minus 05:00:00

Check if info-center is configured to provide timestamp:

[HP] display info-center

Information Center: Enabled
Console: Enabled
Monitor: Enabled
Log host: Enabled
192.100.50.27,
port number: 514, host facility: local7
Log buffer: Enabled
Max buffer size 1024, current buffer size 512
Current messages 66, dropped messages 0, overwritten messages 0
Log file: Enabled
Security log file: Enabled
Information timestamp format:
Log host: Date
Other output destination: Date

Check logfile content to determine if the time stamp is present:

<HP> cd logfile/
<HP> more logfile.log
%@9377%Jan 20 23:31:03:567 2011 HP5930_SUT SHELL/6/SHELL_CMD: -Line=vty0-IPAddr=16.123.122.155-User=admin; Command is dis info-center
%@9378%Jan 20 23:31:09:342 2011 HP5930_SUT SHELL/6/SHELL_CMD: -Line=vty0-IPAddr=16.123.122.155-User=admin; Command is qui

If the HP FlexFabric Switch is not configured to enable timestamp in the log and if time zone is not configurable, this is a finding.

Vulnerability Number

V-66253

Documentable

False

Rule Version

HFFS-ND-000101

Severity Override Guidance

Determine if time zone is configured on the HP FlexFabric Switch:

[HP] display clock

15:00:32 EST Thu 07/09/2015
Time Zone : EST minus 05:00:00

Check if info-center is configured to provide timestamp:

[HP] display info-center

Information Center: Enabled
Console: Enabled
Monitor: Enabled
Log host: Enabled
192.100.50.27,
port number: 514, host facility: local7
Log buffer: Enabled
Max buffer size 1024, current buffer size 512
Current messages 66, dropped messages 0, overwritten messages 0
Log file: Enabled
Security log file: Enabled
Information timestamp format:
Log host: Date
Other output destination: Date

Check logfile content to determine if the time stamp is present:

<HP> cd logfile/
<HP> more logfile.log
%@9377%Jan 20 23:31:03:567 2011 HP5930_SUT SHELL/6/SHELL_CMD: -Line=vty0-IPAddr=16.123.122.155-User=admin; Command is dis info-center
%@9378%Jan 20 23:31:09:342 2011 HP5930_SUT SHELL/6/SHELL_CMD: -Line=vty0-IPAddr=16.123.122.155-User=admin; Command is qui

If the HP FlexFabric Switch is not configured to enable timestamp in the log and if time zone is not configurable, this is a finding.

Check Content Reference

M

Target Key

2971

Comments