The HPE Nimble must configure a syslog server onto a different system or media than the system being audited.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-252203 | HPEN-NM-000300 | SV-252203r814089_rule | Medium |
| Description |
|---|
| Information stored in one location is vulnerable to accidental or incidental deletion or alteration. UDP is used to communicate between the array group and the syslog server (SSL is not supported at this time). This is an issue because DoD requires the use of TCP. One syslog message is generated for each alert and audit log message. Alert severity types include INFO, WARN, and ERROR. |
| STIG | Date |
|---|---|
| HPE Nimble Storage Array Security Technical Implementation Guide | 2022-03-16 |
Details
| Check Text ( C-55659r814087_chk ) |
|---|
| Type "group --info | grep -i syslog" and review the output lines. The "Syslogd enabled" value should be "Yes", and the "Syslogd server" and "Syslogd port" values should contain the correct syslog server and port values. If not, this is a finding. |
| Fix Text (F-55609r814088_fix) |
|---|
| To specify and enable logging of alerts, type "group --edit --syslog_enabled yes --syslog_server |