The Solidcore client Command Line Interface (CLI) must be in lockdown mode.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-213327	MCAC-TE-000101	SV-213327r506897_rule		High

Description
By default, when an endpoint's Solidcore installation is managed by the ePO server, the CLI will automatically be in lockdown mode. This will ensure the endpoint receives all of its Solidcore configuration settings from the ePO server. The CLI can, however, be activated for troubleshooting efforts during which time the ePO settings will not be enforced. Leaving the CLI in an allowed status will prevent the endpoint from receiving changes from the ePO server for the Solidcore client.

Description

By default, when an endpoint's Solidcore installation is managed by the ePO server, the CLI will automatically be in lockdown mode. This will ensure the endpoint receives all of its Solidcore configuration settings from the ePO server. The CLI can, however, be activated for troubleshooting efforts during which time the ePO settings will not be enforced. Leaving the CLI in an allowed status will prevent the endpoint from receiving changes from the ePO server for the Solidcore client.

STIG	Date
McAfee Application Control 8.x Security Technical Implementation Guide	2020-10-02

Details

Check Text ( C-14555r309078_chk )
Determine CLI status. Access the system being reviewed. From an operating system command line, execute the following command: sadmin status If the status for CLI is "Allowed" or "Recovered", this is a finding.

Fix Text (F-14553r309079_fix)
From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Click "Actions". Select "New Client Task Assignment" to open the Client Task Assignment Builder page. Select the "Solidcore 8.x product", "SC: Change Local CLI Access" task type, then click "Create New Task" to open the Client Task Catalog page. Change "CLI status" to "Restrict". Click "Save".

Fix Text (F-14553r309079_fix)

From the ePO server console System Tree, select the "Systems" tab.

Select "This Group and All Subgroups".
Select the asset.
Select "Actions".
Select "Agent".
Click "Actions".
Select "New Client Task Assignment" to open the Client Task Assignment Builder page.

Select the "Solidcore 8.x product", "SC: Change Local CLI Access" task type, then click "Create New Task" to open the Client Task Catalog page.

Change "CLI status" to "Restrict".

Click "Save".