The Central Log Server must be configured to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users).

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-206460	SRG-APP-000148-AU-002270	SV-206460r960969_rule		High

Description
To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses.

Description

To assure accountability and prevent unauthenticated access, organizational users must be identified and authenticated to prevent potential misuse and compromise of the system. Organizational users include organizational employees or individuals the organization deems to have equivalent status of employees (e.g., contractors). Organizational users (and any processes acting on behalf of users) must be uniquely identified and authenticated for all accesses.

STIG	Date
Central Log Server Security Requirements Guide	2024-07-02

Details

Check Text ( C-6720r285624_chk )
Examine the configuration. Verify that individual user accounts are defined within the application. Each account must have a separate identifier. If an authentication server may be used for login, ensure the application audit logs containing management and configuration actions, identify the individual performing each action. If the Central Log Server is not configured to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users), this is a finding.

Check Text ( C-6720r285624_chk )

Examine the configuration.

Verify that individual user accounts are defined within the application. Each account must have a separate identifier. If an authentication server may be used for login, ensure the application audit logs containing management and configuration actions, identify the individual performing each action.

If the Central Log Server is not configured to uniquely identify and authenticate organizational users (or processes acting on behalf of organizational users), this is a finding.

Fix Text (F-6720r285625_fix)
For systems where individual users access, configure and/or manage the system, configure the Central Log Server application so each user is explicitly identified and authenticated. While an authentication server, is often used for logon, this requirement must include instructions for integrating the authentication server so that they system requires unique identification and authentication. Note: Group accounts are not permitted for logon to the Central Log Server.

Fix Text (F-6720r285625_fix)

For systems where individual users access, configure and/or manage the system, configure the Central Log Server application so each user is explicitly identified and authenticated. While an authentication server, is often used for logon, this requirement must include instructions for integrating the authentication server so that they system requires unique identification and authentication.

Note: Group accounts are not permitted for logon to the Central Log Server.