The anti-virus signature file age must not exceed 7 days.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-63071	DTAVSEL-001	SV-77561r1_rule		High

Description
Anti-virus signature files are updated almost daily by anti-virus software vendors. These files are made available to anti-virus clients as they are published. Keeping virus signature files as current as possible is vital to the security of any system. By configuring a system to attempt an anti-virus update on a daily basis, the system is ensured of maintaining an anti-virus signature age of 7 days or less. If the update attempt were to be configured for only once a week, and that attempt failed, the system would be immediately out of date.

Description

Anti-virus signature files are updated almost daily by anti-virus software vendors. These files are made available to anti-virus clients as they are published. Keeping virus signature files as current as possible is vital to the security of any system. By configuring a system to attempt an anti-virus update on a daily basis, the system is ensured of maintaining an anti-virus signature age of 7 days or less. If the update attempt were to be configured for only once a week, and that attempt failed, the system would be immediately out of date.

STIG	Date
McAfee VSEL 1.9/2.0 Local Client Security Technical Implementation Guide	2015-11-30

Details

Check Text ( C-63823r1_chk )
From a desktop browser window, connect to the McAfee VirusScan Enterprise for Linux (VSEL) Monitor (WEB interface) of the Linux system being reviewed and logon with the nails user account. In the VSEL WEB Monitor, under "View", select "Host Summary". In the "Host Summary", verify the "DAT Date:" is within the last 7 days. If the "DAT Date:" is not within the last 7 days, this is a finding. To validate without the Web interface, access the Linux system being reviewed, either at the console or by a SSH connection. At the command line, enter the command "ls -lt /opt/NAI/LinuxShield/engine/dat". The command will return a listing of the avvclean.dat, avvnames.dat and avvscan.dat files. If their respective file dates are not within the last 7 days, this is a finding.

Check Text ( C-63823r1_chk )

From a desktop browser window, connect to the McAfee VirusScan Enterprise for Linux (VSEL) Monitor (WEB interface) of the Linux system being reviewed and logon with the nails user account.

In the VSEL WEB Monitor, under "View", select "Host Summary".
In the "Host Summary", verify the "DAT Date:" is within the last 7 days.

If the "DAT Date:" is not within the last 7 days, this is a finding.

To validate without the Web interface, access the Linux system being reviewed, either at the console or by a SSH connection.
At the command line, enter the command "ls -lt /opt/NAI/LinuxShield/engine/dat".

The command will return a listing of the avvclean.dat, avvnames.dat and avvscan.dat files. If their respective file dates are not within the last 7 days, this is a finding.

Fix Text (F-68989r1_fix)
From a desktop browser window, connect to the McAfee VirusScan Enterprise for Linux (VSEL) Monitor (WEB interface) of the Linux system being reviewed and logon with the nails user account. In the VSEL WEB Monitor, under "Schedule", select "Product Update". Under "When to update", select the "Immediately" radio button, and click on "Next". Under "Choose what to update", select "Virus definition files (also known as DAT files)", click on "Next". Under "Enter a task name", type a unique name for this task, and click on "Finish". Re-validate anti-virus signature file age. To run the Update task manually without the Web interface, access the Linux system being review, either at the console or by a SSH connection. Add a task to /etc/crontab to run the nails updater. At the command line, enter the command "/opt/NAI/LinuxShield/bin/nails task -l". After the task runs, a (Completed) response will be returned.

Fix Text (F-68989r1_fix)

From a desktop browser window, connect to the McAfee VirusScan Enterprise for Linux (VSEL) Monitor (WEB interface) of the Linux system being reviewed and logon with the nails user account.

In the VSEL WEB Monitor, under "Schedule", select "Product Update".
Under "When to update", select the "Immediately" radio button, and click on "Next".
Under "Choose what to update", select "Virus definition files (also known as DAT files)", click on "Next".
Under "Enter a task name", type a unique name for this task, and click on "Finish".

Re-validate anti-virus signature file age.
To run the Update task manually without the Web interface, access the Linux system being review, either at the console or by a SSH connection.
Add a task to /etc/crontab to run the nails updater.
At the command line, enter the command "/opt/NAI/LinuxShield/bin/nails task -l".
After the task runs, a (Completed) response will be returned.