The HYCU server must generate audit records when successful/unsuccessful logon attempts occur.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-246833	HYCU-AU-000005	SV-246833r768163_rule		Medium

Description
Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.

STIG	Date
HYCU for Nutanix Security Technical Implementation Guide	2021-08-03

Details

Check Text ( C-50265r768161_chk )
Check the contents of the "/var/log/audit/audit.log" file. HYCU also maintains Event (Audit) information in the "HYCU Web UI Events" menu. Verify the audit log contains records showing when successful/unsuccessful logon attempts occur. If the audit log is not configured or does not have required contents, this is a finding.

Fix Text (F-50219r768162_fix)
Log on to the HYCU VM console and load the STIG audit rules by using the following commands: 1. cp /usr/share/doc/audit/rules/10-base-config.rules /usr/share/doc/audit/rules/30-stig.rules /usr/share/doc/audit/rules/31-privileged.rules /usr/share/doc/audit/rules/99-finalize.rules /etc/audit/rules.d/ 2. augenrules --load