VMware vRealize Automation 7.x SLES Security Technical Implementation Guide

Version: 2

Updated: 23 Oct 2023

Findings: 209

Findings

V-240344 - The SLES for vRealize must automatically remove or disable temporary user accounts after 72 hours. (medium)
V-240345 - The SLES for vRealize must audit all account creations. (medium)
V-240346 - In addition to auditing new user and group accounts, these watches will alert the system administrator(s) to any modifications. Any unexpected users, groups, or modifications must be investigated for legitimacy. (medium)
V-240347 - The SLES for vRealize must enforce the limit of three consecutive invalid logon attempts by a user during a 15-minute time period. (medium)
V-240348 - The SLES for vRealize must display the Standard Mandatory DoD Notice and Consent Banner before granting access via SSH. (medium)
V-240349 - The SLES for vRealize must limit the number of concurrent sessions to 10 for all accounts and/or account types. (low)
V-240350 - The SLES for vRealize must initiate a session lock after a 15-minute period of inactivity for all connection types. (medium)
V-240351 - The SLES for vRealize must initiate a session lock after a 15-minute period of inactivity for an SSH connection. (medium)
V-240352 - The SLES for vRealize must monitor remote access methods - SSH Daemon. (medium)
V-240353 - The SLES for vRealize must implement DoD-approved encryption to protect the confidentiality of remote access sessions- SSH Daemon. (medium)
V-240354 - The SLES for vRealize must implement DoD-approved encryption to protect the confidentiality of remote access sessions - SSH Client. (medium)
V-240355 - The SLES for vRealize must produce audit records. (medium)
V-240356 - The SLES for vRealize must alert the ISSO and SA (at a minimum) in the event of an audit processing failure. (medium)
V-240357 - The SLES for vRealize must shut down by default upon audit failure (unless availability is an overriding concern). (medium)
V-240358 - The SLES for vRealize must protect audit information from unauthorized read access - ownership. (medium)
V-240359 - The SLES for vRealize must protect audit information from unauthorized read access - group-ownership. (medium)
V-240360 - The SLES for vRealize must protect audit information from unauthorized modification. (medium)
V-240361 - The SLES for vRealize must protect audit information from unauthorized deletion. (medium)
V-240362 - The SLES for vRealize must protect audit information from unauthorized deletion - log directories. (medium)
V-240376 - The SLES for vRealize must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - Permissions. (medium)
V-240377 - The SLES for vRealize must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - ownership. (medium)
V-240378 - The SLES for vRealize must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited - group-ownership. (medium)
V-240379 - The SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using chmod. (medium)
V-240380 - The SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using chown. (medium)
V-240381 - The SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using fchmod. (medium)
V-240382 - The SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using fchmodat. (medium)
V-240383 - The SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using fchown. (medium)
V-240384 - The SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using fchownat. (medium)
V-240385 - The SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using fremovexattr. (medium)
V-240386 - The SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using fsetxattr. (medium)
V-240387 - The SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using lchown. (medium)
V-240388 - The SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using lremovexattr. (medium)
V-240389 - The SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using lsetxattr. (medium)
V-240390 - The SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using removexattr. (medium)
V-240391 - The SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all discretionary access control permission modifications using setxattr. (medium)
V-240392 - The SLES for vRealize must generate audit records when successful/unsuccessful attempts to access privileges occur. The SLES for vRealize must generate audit records for all failed attempts to access files and programs. (medium)
V-240393 - The SLES for vRealize must enforce password complexity by requiring that at least one upper-case character be used. (medium)
V-240394 - Global settings defined in common- {account,auth,password,session} must be applied in the pam.d definition files. (medium)
V-240395 - The SLES for vRealize must enforce password complexity by requiring that at least one lower-case character be used. (medium)
V-240396 - The SLES for vRealize must enforce password complexity by requiring that at least one numeric character be used. (medium)
V-240397 - The SLES for vRealize must require the change of at least eight of the total number of characters when passwords are changed. (high)
V-240398 - The SLES for vRealize must store only encrypted representations of passwords. (high)
V-240399 - The SLES for vRealize must store only encrypted representations of passwords. (high)
V-240400 - SLES for vRealize must enforce 24 hours/1 day as the minimum password lifetime. (medium)
V-240401 - Users must not be able to change passwords more than once every 24 hours. (medium)
V-240402 - SLES for vRealize must enforce a 60-day maximum password lifetime restriction. (medium)
V-240403 - User passwords must be changed at least every 60 days. (medium)
V-240404 - The SLES for vRealize must prohibit password reuse for a minimum of five generations. (medium)
V-240405 - The SLES for vRealize must prohibit password reuse for a minimum of five generations - old passwords are being stored. (medium)
V-240406 - The SLES for vRealize must enforce a minimum 15-character password length. (medium)
V-240407 - The system must require root password authentication upon booting into single-user mode. (medium)
V-240408 - Bootloader authentication must be enabled to prevent users without privilege to gain access to restricted file system resources. (medium)
V-240409 - The system boot loader configuration file(s) must have mode 0600 or less permissive. (medium)
V-240410 - The system boot loader configuration files must be owned by root. (medium)
V-240411 - The system boot loader configuration file(s) must be group-owned by root, bin, sys, or system. (medium)
V-240412 - The Bluetooth protocol handler must be disabled or not installed. (medium)
V-240413 - The system must have USB Mass Storage disabled unless needed. (medium)
V-240414 - The system must have USB disabled unless needed. (medium)
V-240415 - The telnet-server package must not be installed. (medium)
V-240416 - The rsh-server package must not be installed. (medium)
V-240417 - The ypserv package must not be installed. (medium)
V-240418 - The yast2-tftp-server package must not be installed. (medium)
V-240419 - The tftp package must not be installed. (medium)
V-240420 - The Datagram Congestion Control Protocol (DCCP) must be disabled unless required. (medium)
V-240421 - The Stream Control Transmission Protocol (SCTP) must be disabled unless required. (medium)
V-240422 - The Reliable Datagram Sockets (RDS) protocol must be disabled or not installed unless required. (medium)
V-240423 - The Transparent Inter-Process Communication (TIPC) must be disabled or not installed. (medium)
V-240424 - The xinetd service must be disabled if no network services using it are enabled. (medium)
V-240425 - The xinetd.conf file, and the xinetd.d directory must be owned by root or bin. (medium)
V-240426 - The inetd.conf file, xinetd.conf file, and xinetd.d directory must be group owned by root, bin, sys, or system. (medium)
V-240427 - The xinetd.d directory must have mode 0755 or less permissive. (medium)
V-240428 - Xinetd logging/tracing must be enabled. (medium)
V-240429 - The ypbind service must not be running if no network services utilizing it are enabled. (medium)
V-240430 - The system must not use UDP for NIS/NIS+. (medium)
V-240431 - NIS maps must be protected through hard-to-guess domain names. (medium)
V-240432 - Mail relaying must be restricted. (medium)
V-240433 - The alias files must be owned by root. (medium)
V-240434 - The alias files must be group-owned by root or a system group. (medium)
V-240435 - The alias files must have mode 0644 or less permissive. (medium)
V-240436 - Files executed through a mail aliases file must be owned by root and must reside within a directory owned and writable only by root. (medium)
V-240437 - Files executed through a mail aliases file must be group-owned by root, bin, sys, or system, and must reside within a directory group-owned by root, bin, sys, or system. (medium)
V-240438 - Files executed through a mail aliases file must have mode 0755 or less permissive. (medium)
V-240439 - Sendmail logging must not be set to less than nine in the sendmail.cf file. (medium)
V-240440 - The system syslog service must log informational and more severe SMTP service messages. (medium)
V-240441 - The SMTP service log files must be owned by root. (medium)
V-240442 - The SMTP service log file must have mode 0644 or less permissive. (medium)
V-240443 - The SMTP service HELP command must not be enabled. (medium)
V-240444 - The SMTP service SMTP greeting must not provide version information. (medium)
V-240445 - The SMTP service must not use .forward files. (medium)
V-240446 - The SMTP service must not have the EXPN feature active. (medium)
V-240447 - The SMTP service must not have the VRFY feature active. (medium)
V-240448 - The Lightweight User Datagram Protocol (UDP-Lite) must be disabled unless required. (medium)
V-240449 - The Internetwork Packet Exchange (IPX) protocol must be disabled or not installed. (medium)
V-240450 - The AppleTalk protocol must be disabled or not installed. (medium)
V-240451 - The DECnet protocol must be disabled or not installed. (medium)
V-240452 - Proxy Neighbor Discovery Protocol (NDP) must not be enabled on the system. (medium)
V-240453 - The SLES for vRealize must not have 6to4 enabled. (medium)
V-240454 - The SLES for vRealize must not have Teredo enabled. (medium)
V-240455 - The DHCP client must be disabled if not needed. (medium)
V-240456 - The SLES for vRealize must have IEEE 1394 (Firewire) disabled unless needed. (medium)
V-240457 - Duplicate User IDs (UIDs) must not exist for users within the organization. (medium)
V-240458 - The SLES for vRealize must prevent direct logon into the root account. (high)
V-240459 - The SLES for vRealize must enforce SSHv2 for network access to privileged accounts. (medium)
V-240460 - The SLES for vRealize must enforce SSHv2 for network access to non-privileged accounts. (medium)
V-240461 - The SLES for vRealize must disable account identifiers of individuals and roles (such as root) after 35 days of inactivity after password expiration. (medium)
V-240462 - The SLES for vRealize must use mechanisms meeting the requirements of applicable federal laws, Executive orders, directives, policies, regulations, standards, and guidance for authentication to a cryptographic module. (medium)
V-240463 - The SLES for vRealize must uniquely identify and must authenticate non-organizational users (or processes acting on behalf of non-organizational users). (medium)
V-240464 - All GIDs referenced in /etc/passwd must be defined in /etc/group. (medium)
V-240465 - The SLES for vRealize must uniquely identify and must authenticate non-organizational users (or processes acting on behalf of non-organizational users). (medium)
V-240466 - The SLES for vRealize must be configured such that emergency administrator accounts are never automatically removed or disabled. (medium)
V-240467 - The SLES for vRealize must employ strong authenticators in the establishment of nonlocal maintenance and diagnostic sessions. (medium)
V-240468 - The SLES for vRealize must terminate all sessions and network connections related to nonlocal maintenance when nonlocal maintenance is completed. (medium)
V-240469 - The SLES for vRealize must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of Denial of Service (DoS) attacks. (medium)
V-240470 - The SLES for vRealize must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of Denial of Service (DoS) attacks. (medium)
V-240471 - The SLES for vRealize must terminate all network connections associated with a communications session at the end of the session, or as follows: for in-band management sessions (privileged sessions), the session must be terminated after 10 minutes of inactivity; and for user sessions (non-privileged session), the session must be terminated after 15 minutes of inactivity, except to fulfill documented and validated mission requirements. (medium)
V-240472 - The /var/log directory must be group-owned by root. (medium)
V-240473 - The /var/log directory must be owned by root. (medium)
V-240474 - The /var/log directory must have mode 0750 or less permissive. (medium)
V-240475 - The /var/log/messages file must be group-owned by root. (medium)
V-240476 - The /var/log/messages file must be owned by root. (medium)
V-240477 - The /var/log/messages file must have mode 0640 or less permissive. (medium)
V-240478 - The SLES for vRealize must reveal error messages only to authorized users. (medium)
V-240479 - The SLES for vRealize must reveal error messages only to authorized users. (medium)
V-240480 - The SLES for vRealize must reveal error messages only to authorized users. (medium)
V-240482 - The SLES for vRealize must audit all account modifications. (medium)
V-240483 - The SLES for vRealize must audit all account modifications. (medium)
V-240484 - The SLES for vRealize must audit all account disabling actions. (medium)
V-240485 - The SLES for vRealize must audit all account removal actions. (medium)
V-240486 - The SLES for vRealize must implement cryptography to protect the integrity of remote access sessions. (medium)
V-240487 - The SLES for vRealize must initiate session audits at system start-up. (medium)
V-240488 - The SLES for vRealize must produce audit records containing information to establish the identity of any individual or process associated with the event. (medium)
V-240489 - The SLES for vRealize must protect audit tools from unauthorized access. (medium)
V-240490 - The SLES for vRealize must protect audit tools from unauthorized modification. (medium)
V-240491 - The SLES for vRealize must protect audit tools from unauthorized deletion. (medium)
V-240492 - The shared library files must have restrictive permissions. (medium)
V-240493 - Shared library files must have root ownership. (medium)
V-240494 - System executables must have restrictive permissions. (medium)
V-240495 - System executables must have root ownership. (medium)
V-240496 - The SLES for vRealize must enforce password complexity by requiring that at least one special character be used. (medium)
V-240497 - The SLES for vRealize must automatically terminate a user session after inactivity time-outs have expired or at shutdown. (medium)
V-240498 - The SLES for vRealize must control remote access methods. (medium)
V-240499 - The SLES for vRealize must audit all account enabling actions. (medium)
V-240500 - The SLES for vRealize must notify System Administrators and Information System Security Officers when accounts are created, or enabled when previously disabled. (medium)
V-240501 - The SLES for vRealize must audit the execution of privileged functions. (low)
V-240502 - The SLES for vRealize must automatically lock an account until the locked account is released by an administrator when three unsuccessful logon attempts in 15 minutes occur. (low)
V-240503 - The SLES for vRealize must off-load audit records onto a different system or media from the system being audited. (low)
V-240504 - The SLES for vRealize must immediately notify the SA and ISSO (at a minimum) when allocated audit record storage volume reaches 75% of the repository maximum audit record storage capacity. (medium)
V-240505 - The SLES for vRealize must provide an immediate real-time alert to the SA and ISSO, at a minimum, of all audit failure events requiring real-time alerts. (medium)
V-240506 - The SLES for vRealize must, for networked systems, compare internal information system clocks at least every 24 hours with a server which is synchronized to one of the redundant United States Naval Observatory (USNO) time servers, or a time server designated for the appropriate DoD network (NIPRNet/SIPRNet), and/or the Global Positioning System (GPS). (medium)
V-240507 - The time synchronization configuration file (such as /etc/ntp.conf) must be owned by root. (medium)
V-240508 - The time synchronization configuration file (such as /etc/ntp.conf) must be group-owned by root, bin, sys, or system. (medium)
V-240509 - The time synchronization configuration file (such as /etc/ntp.conf) must have mode 0640 or less permissive. (medium)
V-240510 - The SLES for vRealize must synchronize internal information system clocks to the authoritative time source when the time difference is greater than one second. (medium)
V-240511 - The SLES for vRealize must audit the enforcement actions used to restrict access associated with changes to the system. (medium)
V-240512 - The RPM package management tool must cryptographically verify the authenticity of all software packages during installation. (medium)
V-240513 - The SLES for vRealize must audit all activities performed during nonlocal maintenance and diagnostic sessions. (medium)
V-240514 - The SLES for vRealize must implement cryptographic mechanisms to protect the integrity of nonlocal maintenance and diagnostic communications, when used for nonlocal maintenance sessions. (medium)
V-240515 - The SLES for vRealize must implement cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications, when used for nonlocal maintenance sessions. (medium)
V-240516 - The SLES for vRealize must implement NSA-approved cryptography to protect classified information in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. (high)
V-240517 - The SLES for vRealize must protect against or limit the effects of Denial of Service (DoS) attacks by ensuring the SLES for vRealize is implementing rate-limiting measures on impacted network interfaces. (high)
V-240518 - The SLES for vRealize must protect the confidentiality and integrity of transmitted information. (high)
V-240519 - The SLES for vRealize must implement cryptographic mechanisms to prevent unauthorized disclosure of information and/or detect changes to information during transmission unless otherwise protected by alternative physical safeguards, such as, at a minimum, a Protected Distribution System (PDS). (high)
V-240520 - The SLES for vRealize must implement non-executable data to protect its memory from unauthorized code execution. (medium)
V-240521 - The SLES for vRealize must implement address space layout randomization to protect its memory from unauthorized code execution. (medium)
V-240522 - The SLES for vRealize must verify correct operation of all security functions. (medium)
V-240523 - The SLES for vRealize must generate audit records when successful/unsuccessful attempts to access security objects occur. (medium)
V-240524 - The SLES for vRealize must generate audit records when successful/unsuccessful attempts to modify privileges occur. (medium)
V-240525 - The SLES for vRealize must generate audit records when successful/unsuccessful attempts to modify security objects occur. (medium)
V-240526 - The SLES for vRealize must generate audit records when successful/unsuccessful attempts to delete privileges occur. (medium)
V-240527 - The SLES for vRealize must generate audit records when successful/unsuccessful attempts to delete security objects occur. (medium)
V-240528 - The SLES for vRealize must generate audit records when successful/unsuccessful logon attempts occur. (medium)
V-240529 - The SLES for vRealize must generate audit records for privileged activities or other system-level access. (medium)
V-240530 - The SLES for vRealize audit system must be configured to audit the loading and unloading of dynamic kernel modules. (medium)
V-240531 - The SLES for vRealize must generate audit records showing starting and ending time for user access to the system. (medium)
V-240532 - The SLES for vRealize must generate audit records when concurrent logons to the same account occur from different sources. (medium)
V-240533 - The SLES for vRealize must generate audit records when successful/unsuccessful accesses to objects occur. (medium)
V-240534 - The SLES for vRealize audit system must be configured to audit failed attempts to access files and programs. (medium)
V-240535 - The SLES for vRealize audit system must be configured to audit failed attempts to access files and programs. (medium)
V-240536 - The SLES for vRealize audit system must be configured to audit user deletions of files and programs. (medium)
V-240537 - The SLES for vRealize audit system must be configured to audit file deletions. (medium)
V-240538 - SLES for vRealize audit logs must be rotated daily. (medium)
V-240539 - The SLES for vRealize must generate audit records for all direct access to the information system. (medium)
V-240540 - The SLES for vRealize must generate audit records for all account creations, modifications, disabling, and termination events. (medium)
V-240541 - The SLES for vRealize must generate audit records for all kernel module load, unload, and restart actions, and also for all program initiations. (medium)
V-240542 - The SLES for vRealize must implement NIST FIPS-validated cryptography for the following: to provision digital signatures, to generate cryptographic hashes, and to protect unclassified information requiring confidentiality and cryptographic protection in accordance with applicable federal laws, Executive Orders, directives, policies, regulations, and standards. (medium)
V-240543 - The SLES for vRealize must, at a minimum, off-load audit information on interconnected systems in real time and off-load standalone systems weekly. (medium)
V-240544 - The SLES for vRealize must prevent the use of dictionary words for passwords. (medium)
V-240545 - The SLES for vRealize must prevent the use of dictionary words for passwords. (medium)
V-240546 - The SLES for vRealize must prevent the use of dictionary words for passwords. (medium)
V-240547 - The SLES for vRealize must enforce a delay of at least 4 seconds between logon prompts following a failed logon attempt. (medium)
V-240548 - The SLES for vRealize must enforce a delay of at least 4 seconds between logon prompts following a failed logon attempt. (medium)
V-240549 - The SLES for vRealize must enforce a delay of at least 4 seconds between logon prompts following a failed logon attempt. (medium)
V-240550 - The SLES for vRealize must be configured in accordance with the security configuration settings based on DoD security configuration or implementation guidance, including STIGs, NSA configuration guides, CTOs, and DTMs. (medium)
V-240551 - The SLES for vRealize must define default permissions for all authenticated users in such a way that the user can only read and modify their own files. (medium)
V-258447 - The version of vRealize Automation 7.x SLES running on the system must be a supported version. (high)
V-258526 - Any publically accessible connection to the SLES for vRealize must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system. (medium)
V-258527 - The SLES for vRealize audit system must be configured to audit all administrative, privileged, and security actions. (medium)
V-258528 - The SLES for vRealize audit system must be configured to audit all attempts to alter system time through adjtimex. (medium)
V-258529 - The SLES for vRealize audit system must be configured to audit all attempts to alter system time through settimeofday. (medium)
V-258530 - The SLES for vRealize audit system must be configured to audit all attempts to alter system time through stime. (medium)
V-258531 - The SLES for vRealize audit system must be configured to audit all attempts to alter system time through clock_settime. (medium)
V-258532 - The SLES for vRealize audit system must be configured to audit all attempts to alter system time through /etc/localtime. (medium)
V-258533 - The SLES for vRealize audit system must be configured to audit all attempts to alter the system through sethostname. (medium)
V-258534 - The SLES for vRealize audit system must be configured to audit all attempts to alter the system through setdomainname. (medium)
V-258535 - The SLES for vRealize audit system must be configured to audit all attempts to alter the system through sched_setparam. (medium)
V-258536 - The SLES for vRealize audit system must be configured to audit all attempts to alter the system through sched_setscheduler. (medium)
V-258537 - The SLES for vRealize audit system must be configured to audit all attempts to alter /var/log/faillog. (medium)
V-258538 - The SLES for vRealize audit system must be configured to audit all attempts to alter /var/log/lastlog. (medium)
V-258539 - The SLES for vRealize audit system must be configured to audit all attempts to alter /var/log/tallylog. (medium)