Nutanix AOS must protect log information from any type of unauthorized access.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-254107	NUTX-AP-000190	SV-254107r960930_rule		Medium

Description
If log data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. In addition, access to log records provides information an attacker could potentially use to his or her advantage. Application servers contain admin interfaces that allow reading and manipulation of log records. Therefore, these interfaces should not allow unfettered access to those records. Application servers also write log data to log files which are stored on the OS, so appropriate file permissions must also be used to restrict access. Log information includes all information (e.g., log records, log settings, transaction logs, and log reports) needed to successfully log information system activity. Application servers must protect log information from unauthorized read access. Satisfies: SRG-APP-000118-AS-000078, SRG-APP-000119-AS-000079, SRG-APP-000120-AS-000080

Description

If log data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. In addition, access to log records provides information an attacker could potentially use to his or her advantage. Application servers contain admin interfaces that allow reading and manipulation of log records. Therefore, these interfaces should not allow unfettered access to those records. Application servers also write log data to log files which are stored on the OS, so appropriate file permissions must also be used to restrict access. Log information includes all information (e.g., log records, log settings, transaction logs, and log reports) needed to successfully log information system activity. Application servers must protect log information from unauthorized read access. Satisfies: SRG-APP-000118-AS-000078, SRG-APP-000119-AS-000079, SRG-APP-000120-AS-000080

STIG	Date
Nutanix AOS 5.20.x Application Security Technical Implementation Guide	2024-06-18

Details

Check Text ( C-57592r846407_chk )
Confirm Nutanix AOS application server log files are protected from unauthorized read access. The Nutanix AOS application server log files are owned by the Nutanix user and have a file permission of "640". Step 1. Identify actual file name by looking at alert_manager.INFO, which is a symlink for the actual rotating file name. $ sudo ls -al /home/nutanix/data/logs/alert_manager.INFO lrwxrwxrwx. 1 nutanix nutanix 75 Nov 1 17:50 /home/nutanix/data/logs/alert_manager.INFO -> alert_manager.ntnx-.nutanix.log.INFO. Step 2. Execute a stat command on the actual application server log file name. $ sudo stat -c "%a %n" /home/nutanix/data/logs/alert_manager.ntnx-.nutanix.log.INFO. 640 /home/nutanix/data/logs/alert_manager.ntnx.nutanix.log.INFO. If the output of the actual log file name is not "640", this is a finding.

Check Text ( C-57592r846407_chk )

Confirm Nutanix AOS application server log files are protected from unauthorized read access.

The Nutanix AOS application server log files are owned by the Nutanix user and have a file permission of "640".

Step 1. Identify actual file name by looking at alert_manager.INFO, which is a symlink for the actual rotating file name.
$ sudo ls -al /home/nutanix/data/logs/alert_manager.INFO
lrwxrwxrwx. 1 nutanix nutanix 75 Nov 1 17:50 /home/nutanix/data/logs/alert_manager.INFO -> alert_manager.ntnx-.nutanix.log.INFO.

Step 2. Execute a stat command on the actual application server log file name.
$ sudo stat -c "%a %n" /home/nutanix/data/logs/alert_manager.ntnx-.nutanix.log.INFO.
640 /home/nutanix/data/logs/alert_manager.ntnx.nutanix.log.INFO.

If the output of the actual log file name is not "640", this is a finding.

Fix Text (F-57543r846408_fix)
To configure Nutanix AOS Prism Elements application server log file permissions, run the following command: $ sudo salt-call state.sls security/CVM/interactivenutanixCVM