UCF STIG Viewer Logo

The Photon operating system must have the auditd service running.


Overview

Finding ID Version Rule ID IA Controls Severity
V-239090 PHTN-67-000018 SV-239090r856039_rule Medium
Description
Without the capability to generate audit records, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one. To that end, the auditd service must be configured to start automatically and be running at all times. Satisfies: SRG-OS-000062-GPOS-00031, SRG-OS-000042-GPOS-00021, SRG-OS-000255-GPOS-00096, SRG-OS-000363-GPOS-00150, SRG-OS-000365-GPOS-00152, SRG-OS-000445-GPOS-00199, SRG-OS-000446-GPOS-00200, SRG-OS-000461-GPOS-00205, SRG-OS-000465-GPOS-00209, SRG-OS-000467-GPOS-00211, SRG-OS-000474-GPOS-00219, SRG-OS-000475-GPOS-00220
STIG Date
VMware vSphere 6.7 Photon OS Security Technical Implementation Guide 2022-09-27

Details

Check Text ( C-42301r675076_chk )
At the command line, execute the following command:

# service auditd status | grep running

If the service is not running, this is a finding.
Fix Text (F-42260r675077_fix)
At the command line, execute the following command:

# systemctl enable auditd.service
# service auditd start