The McAfee VirusScan Enterprise for Linux 1.9.x/2.0.x must be configured to enable On-Access scanning.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-63075	DTAVSEL-003	SV-77565r1_rule		High

Description
For anti-virus software to be effective, it must be running at all times, beginning from the point of the system's initial startup. Otherwise, the risk is greater for viruses, Trojans, and other malware infecting the system during that startup phase.

STIG	Date
McAfee VSEL 1.9/2.0 Local Client Security Technical Implementation Guide	2020-03-24

Details

Check Text ( C-63827r1_chk )
Note: McAfee VSEL On-Access scan is not compatible with NFS Version 4. On client systems with the NFS 4.0 client as default, execute the following command to use NFS version 3.0 as a workaround: mount -t nfs -o nfsvers=3 If mounting with NFS version 3.0 is not an option, this is a finding. Only in such case, if STIG ID DTAVSEL-100 is configured for a daily scheduled scan and DTAVSEL-101 through DTAVSEL-114 are not a finding, the severity of this check can be reduced to a CAT 2. From a desktop browser window, connect to the McAfee VirusScan Enterprise for Linux (VSEL) Monitor (WEB interface) of the Linux system being reviewed and logon with the nails user account. In the VSEL WEB Monitor, under "Configure", select "On-Access Settings". Under "Anti-virus Scanning Options", verify the "Enable On-Access scanning" check box is selected. Verify the "Quarantine directory" field is populated with "/quarantine" (or another valid location as determined by the organization). If the check box "Enable On-Access scanning" is not selected, this is a finding. If the "Quarantine directory" field is not populated, this is a finding. To validate without the Web interface, access the Linux system being reviewed, either at the console or by a SSH connection. At the command line, navigate to /var/opt/NAI/LinuxShield/etc. Enter the command "grep "oasEnabled" nailsd.cfg" If the response given is "nailsd.oasEnabled: false" or is "nailsd.oasEnabled: true" with a preceding #, this is a finding.

Check Text ( C-63827r1_chk )

Note: McAfee VSEL On-Access scan is not compatible with NFS Version 4. On client systems with the NFS 4.0 client as default, execute the following command to use NFS version 3.0 as a workaround:
mount -t nfs -o nfsvers=3

If mounting with NFS version 3.0 is not an option, this is a finding.

Only in such case, if STIG ID DTAVSEL-100 is configured for a daily scheduled scan and DTAVSEL-101 through DTAVSEL-114 are not a finding, the severity of this check can be reduced to a CAT 2.

From a desktop browser window, connect to the McAfee VirusScan Enterprise for Linux (VSEL) Monitor (WEB interface) of the Linux system being reviewed and logon with the nails user account.

In the VSEL WEB Monitor, under "Configure", select "On-Access Settings".
Under "Anti-virus Scanning Options", verify the "Enable On-Access scanning" check box is selected.
Verify the "Quarantine directory" field is populated with "/quarantine" (or another valid location as determined by the organization).

If the check box "Enable On-Access scanning" is not selected, this is a finding.

If the "Quarantine directory" field is not populated, this is a finding.

To validate without the Web interface, access the Linux system being reviewed, either at the console or by a SSH connection.
At the command line, navigate to /var/opt/NAI/LinuxShield/etc.
Enter the command "grep "oasEnabled" nailsd.cfg"

If the response given is "nailsd.oasEnabled: false" or is "nailsd.oasEnabled: true" with a preceding #, this is a finding.

Fix Text (F-68993r1_fix)
From a desktop browser window, connect to the McAfee VirusScan Enterprise for Linux (VSEL) Monitor (WEB interface) of the Linux system being reviewed and logon with the nails user account. In the VSEL WEB Monitor, under "Configure", select "On-Access Settings". Under "Anti-virus Scanning Options", select the "Enable On-Access scanning" check box. In the "Quarantine directory" field, populate with "/quarantine" (or another valid location as determined by the organization). Click "Apply".

Fix Text (F-68993r1_fix)

From a desktop browser window, connect to the McAfee VirusScan Enterprise for Linux (VSEL) Monitor (WEB interface) of the Linux system being reviewed and logon with the nails user account.

In the VSEL WEB Monitor, under "Configure", select "On-Access Settings".
Under "Anti-virus Scanning Options", select the "Enable On-Access scanning" check box.
In the "Quarantine directory" field, populate with "/quarantine" (or another valid location as determined by the organization).
Click "Apply".