The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x On-Access scanner must only be configured with exclusions that are documented and approved by the ISSO/ISSM/AO.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-63093	DTAVSEL-012	SV-77583r1_rule		Medium

Description
When scanning for malware, excluding specific files will increase the risk of a malware-infected file going undetected. By configuring anti-virus software without any exclusions, the scanner has a higher success rate at detecting and eradicating malware.

STIG	Date
McAfee VSEL 1.9/2.0 Local Client Security Technical Implementation Guide	2015-11-30

Details

Check Text ( C-63845r1_chk )
From a desktop browser window, connect to the McAfee VirusScan Enterprise for Linux (VSEL) Monitor (WEB interface) of the Linux system being reviewed and logon with the nails user account. In the VSEL WEB Monitor, under "Configure", select "On-Access Settings". Under "Paths Excluded From Scanning", verify no entries exist other than the following: /var/log /_admin/Manage_NSS /mnt/system/log /media/nss/./(\._NETWARE\|\._ADMIN) /.\.(vmdk\|VMDK\|dbl\|DBL\|ctl\|CTL\|log\|LOG\|jar\|JAR\|war\|WAR\|dtx\|DTX\|dbf\|DBF\|frm\|FRM\|myd\|MYD\|myi\|MYI\|rdo\|RDO\|arc\|ARC) /cgroup /dev /proc /selinux /sys If any entries other than the above referenced paths are present in the "Paths Excluded From Scanning" field, verify the exclusion of those files and paths have been formally documented by the System Administrator and has been approved by the ISSO/ISSM. If they have not been formally documented by the System Administrator and approved by the ISSO/ISSM, this is a finding. If they have not been formally documented by the System Administrator and approved by the ISSO/ISSM but are validated as being scanned within the regularly scheduled scan, this is a finding but can be dropped to a CAT 3. To validate without the Web interface, access the Linux system being reviewed, either at the console or by a SSH connection. At the command line, navigate to /var/opt/NAI/LinuxShield/etc. Enter the command "grep "exclude-path" nailsd.cfg -A 5" If the response given is: "nailsd.profile.OAS.filter.varlog.type: exclude-path" and "nailsd.profile.OAS.filter.varlog.path:" includes anything other than the above paths", this is a finding.

Check Text ( C-63845r1_chk )

From a desktop browser window, connect to the McAfee VirusScan Enterprise for Linux (VSEL) Monitor (WEB interface) of the Linux system being reviewed and logon with the nails user account.

In the VSEL WEB Monitor, under "Configure", select "On-Access Settings".

Under "Paths Excluded From Scanning", verify no entries exist other than the following:
/var/log
/_admin/Manage_NSS
/mnt/system/log
/media/nss/.*/(\._NETWARE|\._ADMIN)
/.*\.(vmdk|VMDK|dbl|DBL|ctl|CTL|log|LOG|jar|JAR|war|WAR|dtx|DTX|dbf|DBF|frm|FRM|myd|MYD|myi|MYI|rdo|RDO|arc|ARC)
/cgroup
/dev
/proc
/selinux
/sys

If any entries other than the above referenced paths are present in the "Paths Excluded From Scanning" field, verify the exclusion of those files and paths have been formally documented by the System Administrator and has been approved by the ISSO/ISSM.

If they have not been formally documented by the System Administrator and approved by the ISSO/ISSM, this is a finding.

If they have not been formally documented by the System Administrator and approved by the ISSO/ISSM but are validated as being scanned within the regularly scheduled scan, this is a finding but can be dropped to a CAT 3.

To validate without the Web interface, access the Linux system being reviewed, either at the console or by a SSH connection.
At the command line, navigate to /var/opt/NAI/LinuxShield/etc.
Enter the command "grep "exclude-path" nailsd.cfg -A 5"

If the response given is: "nailsd.profile.OAS.filter.varlog.type: exclude-path" and "nailsd.profile.OAS.filter.varlog.path:" includes anything other than the above paths", this is a finding.

Fix Text (F-69011r1_fix)
From a desktop browser window, connect to the McAfee VirusScan Enterprise for Linux (VSEL) Monitor (WEB interface) of the Linux system being reviewed and logon with the nails user account. In the VSEL WEB Monitor, under "Configure", select "On-Access Settings". Click "Edit". Under "Paths Excluded From Scanning", remove all entries other than the default "/var/log". Click "Apply".