Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-239079 | PHTN-67-000007 | SV-239079r675045_rule | Medium |
Description |
---|
Automated monitoring of remote access sessions allows organizations to detect cyberattacks and ensure ongoing compliance with remote access policies by auditing connection activities. Shipping sshd authentication events to syslog allows organizations to use their log aggregators to correlate forensic activities among multiple systems. |
STIG | Date |
---|---|
VMware vSphere 6.7 Photon OS Security Technical Implementation Guide | 2021-04-15 |
Check Text ( C-42290r675043_chk ) |
---|
At the command line, execute the following command: # grep "^authpriv" /etc/rsyslog.conf Expected result: authpriv.* /var/log/audit/sshinfo.log If the command does not return any output, this is a finding. |
Fix Text (F-42249r675044_fix) |
---|
Open /etc/rsyslog.conf with a text editor and locate the following line: $IncludeConfig /etc/vmware-syslog/syslog.conf Ensure that the following entry is put beneath the stated line and before the "# vmware services" line. authpriv.* /var/log/audit/sshinfo.log If the following line is at the end of the file, it must be removed or commented out: auth.* /var/log/auth.log At the command line, execute the following command: # systemctl restart syslog # service sshd reload |