STIGQter: STIG Summary: HP FlexFabric Switch NDM Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Jul 2020:

The HP FlexFabric Switch must record time stamps for audit records that meet a granularity of one second for a minimum degree of precision.

DISA Rule

SV-80745r1_rule

Vulnerability Number

V-66255

Group Title

SRG-APP-000375-NDM-000300

Rule Version

HFFS-ND-000102

Severity

CAT II

CCI(s)

• CCI-001889 - The information system records time stamps for audit records that meet organization-defined granularity of time measurement.

Weight

10

Fix Recommendation

Configure timestamp on the logs on the HP FlexFabric Switch:

[HP] info-center timestamp date

By default, the device uses internal system clocks to generate time stamps for audit records in the date format - MMM DD hh:mm:ss:xxx YYYY which provides required granularity.

Check Contents

Check if info-center is configured to provide timestamp:

[HP] display info-center

Information Center: Enabled
Console: Enabled
Monitor: Enabled
Log host: Enabled
192.100.50.27,
port number: 514, host facility: local7
Log buffer: Enabled
Max buffer size 1024, current buffer size 512
Current messages 66, dropped messages 0, overwritten messages 0
Log file: Enabled
Security log file: Enabled
Information timestamp format:
Log host: Date
Other output destination: Date
Check logfile content to determine if the time stamp is present:

<HP> cd logfile/
<HP> more logfile.log
%@9377%Jan 20 23:31:03:567 2011 HP5930_SUT SHELL/6/SHELL_CMD: -Line=vty0-IPAddr=16.123.122.155-User=admin; Command is dis info-center
%@9378%Jan 20 23:31:09:342 2011 HP5930_SUT SHELL/6/SHELL_CMD: -Line=vty0-IPAddr=16.123.122.155-User=admin; Command is qui

If the HP FlexFabric Switch is not configured to enable timestamp, this is a finding.

Vulnerability Number

V-66255

Documentable

False

Rule Version

HFFS-ND-000102

Severity Override Guidance

Check if info-center is configured to provide timestamp:

[HP] display info-center

Information Center: Enabled
Console: Enabled
Monitor: Enabled
Log host: Enabled
192.100.50.27,
port number: 514, host facility: local7
Log buffer: Enabled
Max buffer size 1024, current buffer size 512
Current messages 66, dropped messages 0, overwritten messages 0
Log file: Enabled
Security log file: Enabled
Information timestamp format:
Log host: Date
Other output destination: Date
Check logfile content to determine if the time stamp is present:

<HP> cd logfile/
<HP> more logfile.log
%@9377%Jan 20 23:31:03:567 2011 HP5930_SUT SHELL/6/SHELL_CMD: -Line=vty0-IPAddr=16.123.122.155-User=admin; Command is dis info-center
%@9378%Jan 20 23:31:09:342 2011 HP5930_SUT SHELL/6/SHELL_CMD: -Line=vty0-IPAddr=16.123.122.155-User=admin; Command is qui

If the HP FlexFabric Switch is not configured to enable timestamp, this is a finding.

Check Content Reference

M

Target Key

2971

Comments