UCF STIG Viewer Logo

The Photon operating system must have sshd authentication logging enabled.


Finding ID Version Rule ID IA Controls Severity
V-239079 PHTN-67-000007 SV-239079r675045_rule Medium
Automated monitoring of remote access sessions allows organizations to detect cyberattacks and ensure ongoing compliance with remote access policies by auditing connection activities. Shipping sshd authentication events to syslog allows organizations to use their log aggregators to correlate forensic activities among multiple systems.
VMware vSphere 6.7 Photon OS Security Technical Implementation Guide 2022-06-17


Check Text ( C-42290r675043_chk )
At the command line, execute the following command:

# grep "^authpriv" /etc/rsyslog.conf

Expected result:

authpriv.* /var/log/audit/sshinfo.log

If the command does not return any output, this is a finding.
Fix Text (F-42249r675044_fix)
Open /etc/rsyslog.conf with a text editor and locate the following line:

$IncludeConfig /etc/vmware-syslog/syslog.conf

Ensure that the following entry is put beneath the stated line and before the "# vmware services" line.

authpriv.* /var/log/audit/sshinfo.log

If the following line is at the end of the file, it must be removed or commented out:

auth.* /var/log/auth.log

At the command line, execute the following command:

# systemctl restart syslog
# service sshd reload