{"stig":{"title":"HYCU Protege Security Technical Implementation Guide","version":"1","release":"2"},"checks":[{"vulnId":"V-268216","ruleId":"SV-268216r1038348_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must be configured to synchronize internal information system clocks using redundant authoritative time sources.","description":"The loss of connectivity to a particular authoritative time source will result in the loss of time synchronization (free-run mode) and increasingly inaccurate time stamps on audit events and other functions. \n\nMultiple time sources provide redundancy by including a secondary source. Time synchronization is usually a hierarchy; clients synchronize time to a local source while that source synchronizes its time to a more accurate source. The network device must use an authoritative time server and/or be configured to use redundant authoritative time sources. This requirement is related to the comparison done in CCI-001891.\n\nDOD-approved solutions consist of a combination of a primary and secondary time source using a combination or multiple instances of the following: a time server designated for the appropriate DOD network (NIPRNet/SIPRNet); United States Naval Observatory (USNO) time servers; and/or the Global Positioning System (GPS). The secondary time source must be located in a different geographic region than the primary time source.\n\nSatisfies: SRG-APP-000920-NDM-000320, SRG-APP-000925-NDM-000330","checkContent":"Verify the \"chronyd\" service is up and running, execute the following command:\nsystemctl status chronyd\n\nIf service is not active (running), this is a finding.\n\nTo verify chronyd has synced time and can reach the servers execute the following command:\nchronyc sources\n\nIf there are not two NTP servers listed, this is a finding.\n\nIf the \"Reach\" value is lower than \"377\" for the source with S column marked with \"*\" this is a finding.","fixText":"Start the time synchronization by logging on to the HYCU console and executing the following command:\nsudo systemctl restart chronyd\n\nAdditional assistance can be found at: https://support.hycu.com/hc/en-us/articles/115005424345-HYCU-system-time","ccis":["CCI-004922","CCI-004923"]},{"vulnId":"V-268217","ruleId":"SV-268217r1067634_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must not have any default manufacturer passwords when deployed.","description":"Virtual machines not protected with strong password schemes provide the opportunity for anyone to crack the password and gain access to the device, which can result in loss of availability, confidentiality, or integrity of network traffic. Many default vendor passwords are well known or are easily guessed; therefore, not removing them prior to deploying the network device into production provides an opportunity for a malicious user to gain unauthorized access to the device.","checkContent":"Log in to the HYCU VM console with the default vendor credentials.\n\nIf the login to the console is successful with the default credentials, this is a finding.\n\nLog in to the HYCU Web UI with the default vendor credentials.\n\nIf the login to the HYCU Web UI is successful with the default credentials, this is a finding.","fixText":"Log in to the HYCU VM console with the default username and password.\n\nRun the passwd command to change the default password.\n \nLog in to the HYCU Web UI with the default password and change the password by selecting the \"Admin\" account in the upper-right corner and changing the password. This logs off the admin account and prompts the user to log in with the updated credentials.","ccis":["CCI-004061"]},{"vulnId":"V-268219","ruleId":"SV-268219r1038638_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must limit the number of concurrent sessions to an organization-defined number for each administrator account and/or administrator account type.","description":"Device management includes the ability to control the number of administrators and management sessions that manage a device. Limiting the number of allowed administrators and sessions per administrator based on account type, role, or access type is helpful in limiting risks related to denial-of-service (DoS) attacks.\n\nThis requirement addresses concurrent sessions for administrative accounts and does not address concurrent sessions by a single administrator via multiple administrative accounts. The maximum number of concurrent sessions should be defined based upon mission needs and the operational environment for each system. At a minimum, limits must be set for SSH, HTTPS, account of last resort, and root account sessions.","checkContent":"In the HYCU Web UI, only one login can be used at a time. \n\nIf the user is still logged into the HYCU Web UI upon logging in to the Web UI again, in a different browser tab, with the same credentials, this is a finding.\n\nLog in to the HYCU VM console. To check the number of allowed concurrent session connections, grep file \"/etc/security/limits.conf\" by executing the following command:\ngrep maxlogins /etc/security/limits.conf\n\nVerify the following line exists:\nhycu            hard    maxlogins       1\n\nIf the \"maxlogins\" value is not set to 1 or is missing, this is a finding.","fixText":"The Web UI will only always allow one user session at a time.\n\nFor CLI, configure the operating system to limit the max number of concurrent sessions to 1 by adding the following line to \"/etc/security/limits.conf\":\n\nhycu            hard    maxlogins       1","ccis":["CCI-000054"]},{"vulnId":"V-268222","ruleId":"SV-268222r1137874_rule","severity":"high","ruleTitle":"The HYCU virtual appliance must enforce the assigned privilege level for each administrator and authorizations for access to all commands relative to the privilege level in accordance with applicable policy for the device.","description":"To mitigate the risk of unauthorized access to sensitive information by entities that have been issued certificates by DOD-approved PKIs, all DOD systems must be properly configured to incorporate access control methods that do not rely solely on the possession of a certificate for access. Successful authentication must not automatically give an entity access to an asset or security boundary. Authorization procedures and controls must be implemented to ensure each authenticated entity also has a validated and current authorization. Authorization is the process of determining whether an entity, once authenticated, is permitted to access a specific asset. Network devices use access control policies and enforcement mechanisms to implement this requirement.","checkContent":"Review the Self-Service menu within HYCU to view accounts and user roles (Administrator, Backup Operator, Restore Operator, Backup and Restore Operator, or Viewer).\n\nUser roles have a predefined and nonchangeable set of user privileges. To check exact set of privileges of each user, navigate to Self-Service context in the HYCU UI.\n\nClick on the question mark in the upper-right corner, followed by \"Help with This Page\". Scroll down to the \"User Roles\" section.\n\nIf users can perform more functions than those specified for their role, this is a finding.","fixText":"Apply the appropriate user role to the required user from one of the predefined and nonchangeable roles: Administrator, Backup Operator, Restore Operator, Backup and Restore Operator, or Viewer.","ccis":["CCI-000213"]},{"vulnId":"V-268223","ruleId":"SV-268223r1137878_rule","severity":"medium","ruleTitle":"If the HYCU virtual appliance uses role-based access control, it must enforce organization-defined role-based access control policies over defined subjects and objects.","description":"Organizations can create specific roles based on job functions and the authorizations (i.e., privileges) to perform needed operations on organizational information systems associated with the organization-defined roles. When administrators are assigned to the organizational roles, they inherit the authorizations or privileges defined for those roles. Role-Based Access Control (RBAC) simplifies privilege administration for organizations because privileges are not assigned directly to every administrator (which can be a significant number of individuals for mid- to large-size organizations) but are instead acquired through role assignments. RBAC can be implemented either as a mandatory or discretionary form of access control.\n\nThe RBAC policies and the subjects and objects are defined uniquely for each network device, so they cannot be specified in the requirement.","checkContent":"HYCU offers the capability to leverage RBAC controls within the Web UI's Self-Service menu. The organization would need to generate and document its own specific requirements around using RBAC in HYCU. \n\nFor the HYCU VM console, administrators should only allow access to anyone else deemed to be qualified as a server administrator for the system. \n\nReview the groups and accounts within Web UI's Self-Service menu.\n\nIf any RBAC setting does not meet the organization's guidelines, this is a finding.","fixText":"Ensure the correct RBAC controls and access are applied properly within the HYCU Web UI's Self-Service menu. Avoid granting too much access to any particular user or group. \n\nFor the HYCU VM console, administrators should only allow access to anyone else deemed to be qualified as a server administrator for the system. \n\nTo check for any unauthorized users, run the following command within the HYCU Web console: \ncat /etc/passwd\n\nUse the \"userdel\" command to remove any unauthorized users.","ccis":["CCI-002169","CCI-000366"]},{"vulnId":"V-268225","ruleId":"SV-268225r1137875_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must enforce approved authorizations for controlling the flow of management information within the appliance based on information flow control policies.","description":"A mechanism to detect and prevent unauthorized communication flow must be configured or provided as part of the system design. If management information flow is not enforced based on approved authorizations, the network device may become compromised. Information flow control regulates where management information is allowed to travel within a network device. The flow of all management information must be monitored and controlled so it does not introduce any unacceptable risk to the network device or data.\n\nSatisfies: SRG-APP-000038-NDM-000213, SRG-APP-000880-NDM-000290","checkContent":"Verify the firewall is running by executing the following command:\nsudo firewall-cmd --state\n\nIf service is not running, this is a finding.\n\nDetermine which services and ports are open by executing the following command:\nsudo firewall-cmd --list-all\n\nOutput should show the following two lines:\n\n'services: cockpit dhcpv6-client iscsi-target samba ssh'\n'ports: 8443/tcp'\n\nIf more services than those listed above are open, this is a finding.","fixText":"Enable the firewall by executing the following commands:\nsudo systemctl enable firewalld\n\nsudo systemctl start firewalld","ccis":["CCI-001368","CCI-004192"]},{"vulnId":"V-268226","ruleId":"SV-268226r1038378_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must audit the execution of privileged functions.","description":"Misuse of privileged functions, either intentionally or unintentionally by authorized users, or by unauthorized external entities that have compromised information system accounts, is a serious and ongoing concern and can have significant adverse impacts on organizations. Auditing the use of privileged functions is one way to detect such misuse and identify the risk from insider threats and the advanced persistent threat.","checkContent":"Check the contents of the \"/var/log/audit/audit.log\" file.\n\nHYCU also maintains Event (Audit) information in the HYCU Web UI Events menu.\n\nVerify the audit log contains records showing when the execution of privileged functions occurred.\n\nIf the audit log is not configured or does not have the required contents, this is a finding.","fixText":"Configure HYCU to audit the execution of the \"execve\" system call.\n\nAdd or update the following file system rules to \"/etc/audit/rules.d/audit.rules\":\n-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv\n-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv\n\n-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv\n-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv\n\nReboot the appliance to take effect.","ccis":["CCI-002234"]},{"vulnId":"V-268227","ruleId":"SV-268227r1038750_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must be configured to enforce the limit of three consecutive invalid login attempts, after which time it must block any login attempt for 15 minutes.","description":"By limiting the number of failed login attempts, the risk of unauthorized system access via user password guessing, otherwise known as brute-forcing, is reduced.","checkContent":"Log in to the HYCU VM console and go to the \"/etc/pam.d/\" folder. Verify that \"password-auth\" and \"system-auth\" contain the following three lines, and the values for deny and unlock_time are as shown.\n\nCommands:\nsudo grep pam_faillock.so /etc/pam.d/password-auth\nsudo grep pam_faillock.so /etc/pam.d/system-auth\n\nBoth should displays the following three lines:\nauth        required                                     pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=60 unlock_time=900\nauth        required                                     pam_faillock.so authfail audit unlock_time=900\naccount     required                                     pam_faillock.so\n\nIf the required content is not present, this is a finding.","fixText":"Log in to the server virtual console and navigate to the \"/etc/pam.d/\" folder.\n\nMove the current configuration and make new copies to be edited by executing the following commands:\n\nsudo cp password-auth password-auth-as\n\nsudo cp system-auth system-auth-as\n\nEdit the files \"password-auth\" and \"system-auth\".\n\nAdd the lines:\nauth        required                                     pam_faillock.so preauth silent audit deny=3 even_deny_root fail_interval=60 unlock_time=900\nafter line \nauth        required                                     pam_env.so\n\nAdd:\nauth        required                                     pam_faillock.so authfail audit unlock_time=900\nafter\nauth        sufficient                                   pam_unix.so nullok\n\nAdd:\naccount     required                                     pam_faillock.so\nbefore \naccount     required                                     pam_unix.so\n\nThe files \"system-auth\" and \"password-auth\" are identical, so the procedure can be done on one of the files and copied to the second one.\n\nRestart sssd service:\nsudo systemctl restart sssd.service","ccis":["CCI-000044"]},{"vulnId":"V-268228","ruleId":"SV-268228r1038752_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the device.","description":"Display of the DOD-approved use notification before granting access to the network device ensures privacy and security notification verbiage used is consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidance.","checkContent":"Log in to the HYCU VM console and verify the banner setting is in use in the \"/etc/ssh/sshd_config\" file by executing the following command:\ngrep Banner /etc/ssh/sshd_config\n\nIf the banner is not set to \"/etc/issue\", this is a finding.\n\nVerify \"/etc/issue\" contains valid DOD notice text by executing the following command:\nsudo cat /etc/issue\n\nIf the DOD notice is not present in the \"/etc/issue\" file, this is a finding.\n\nOpen the HYCU Web UI login page and verify the mandatory notice is present on the welcome page.\n\nIf the mandatory notice is not present at the HYCU Web UI welcome page, this is a finding.","fixText":"The GUI login page welcome message and look of the console/ssh login can be changed by following the procedure below:\n\n1. Open a remote session to the HYCU backup controller:\nssh hycu@<HYCUBackupControllerIPAddress>\n\n2. Create the /hycudata/var/branding folder by executing:\nsudo mkdir -p /hycudata/var/branding\n\n3. Make the following files available in /hycudata/var/branding:\nloginImage.PNG/ JPG - Login screen background (1574?×?1920)\n\nconsole.txt - Pre-login banner for text-based console\n\nsshd.txt - Pre-login banner for SSH access\n\n3. Update the branding configuration by running the following command:\nsudo /opt/grizzly/bin/hycu-branding.sh\n\n4. Perform a hard reload of the HYCU Web UI page in the web browser.","ccis":["CCI-000048"]},{"vulnId":"V-268229","ruleId":"SV-268229r1038748_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must retain the Standard Mandatory DOD Notice and Consent Banner on the screen until the administrator acknowledges the usage conditions and takes explicit actions to log in for further access.","description":"The banner must be acknowledged by the administrator prior to the device allowing the administrator access to the network device. This provides assurance that the administrator has seen the message and accepted the conditions for access. If the consent banner is not acknowledged by the administrator, DOD will not comply with system use notifications required by law.","checkContent":"Log in to the HYCU VM console and verify the banner setting is in use in the \"/etc/ssh/sshd_config\" file by executing the following command:\ngrep Banner /etc/ssh/sshd_config\n\nIf the banner is not set to \"/etc/issue\", this is a finding.\n\nVerify \"/etc/issue\" contains valid DOD notice text by executing the following command:\nsudo cat /etc/issue\n\nIf DOD Notice is not present in the \"/etc/issue\" file, this is a finding.\n\nOpen the HYCU Web UI login page and verify the mandatory notice is present on the Welcome page.\n\nIf the mandatory notice is not present at HYCU Web UI Welcome page, this is a finding.","fixText":"Change the GUI login page welcome message and look of the console/ssh login by following the procedure below:\n\n1. Open a remote session to the HYCU backup controller:\nssh hycu@<HYCUBackupControllerIPAddress>\n\n2. Create the /hycudata/var/branding folder by executing:\nsudo mkdir -p /hycudata/var/branding\n\n3. Make the following files available in /hycudata/var/branding:\nloginImage.PNG/ JPG - Login screen background (1920 x 1440)\n\nconsole.txt - Pre-login banner for text-based console\n\nsshd.txt - Pre-login banner for SSH access\n\n4. Update the branding configuration by running the following command:\nsudo /opt/grizzly/bin/hycu-branding.sh\n\n5. Perform a hard reload of the HYCU Web UI page in the web browser.","ccis":["CCI-000050"]},{"vulnId":"V-268231","ruleId":"SV-268231r1038648_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must automatically audit account creation.","description":"Upon gaining access to a network device, an attacker will often first attempt to create a persistent method of reestablishing access. One way to accomplish this is to create a new account. Notification of account creation helps to mitigate this risk. Auditing account creation provides the necessary reconciliation that account management procedures are being followed. Without this audit trail, personnel without the proper authorization may gain access to critical network nodes.","checkContent":"Verify the operating system must generate audit records for all account creations events.\n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n# grep -E \"/etc/passwd|/etc/gshadow|/etc/shadow|/etc/security/opasswd|/etc/group|/etc/sudoers|/etc/sudoers.d/\" /etc/audit/audit.rules\n\n-w /etc/passwd -p wa -k identity\n-w /etc/gshadow -p wa -k identity\n-w /etc/shadow -p wa -k identity\n-w /etc/security/opasswd -p wa -k identity\n-w /etc/group -p wa -k identity\n-w /etc/sudoers -p wa -k identity\n-w /etc/sudoers.d/ -p wa -k identity\n\nIf the command does not return all the lines above, or one or more of the lines are commented out, this is a finding.","fixText":"Log in to the HYCU VM console and load the STIG audit rules by using the following commands:\n\n1. cp /usr/share/audit/sample-rules/10-base-config.rules /usr/share/audit/sample-rules/30-stig.rules /usr/share/audit/sample-rules/31-privileged.rules /usr/share/audit/sample-rules/99-finalize.rules /etc/audit/rules.d/\n\n2. augenrules --load","ccis":["CCI-000018"]},{"vulnId":"V-268232","ruleId":"SV-268232r1038650_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must automatically audit account modification.","description":"Since the accounts in the network device are privileged or system-level accounts, account management is vital to the security of the network device. Account management by a designated authority ensures access to the network device is being controlled in a secure manner by granting access to only authorized personnel with the appropriate and necessary privileges. Auditing account modification along with an automatic notification to appropriate individuals will provide the necessary reconciliation that account management procedures are being followed. If modifications to management accounts are not audited, reconciliation of account management procedures cannot be tracked.","checkContent":"Verify the operating system must generate audit records for all account modification events.\n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n# grep -E \"/etc/passwd|/etc/gshadow|/etc/shadow|/etc/security/opasswd|/etc/group|/etc/sudoers|/etc/sudoers.d/\" /etc/audit/audit.rules\n\n-w /etc/passwd -p wa -k identity\n-w /etc/gshadow -p wa -k identity\n-w /etc/shadow -p wa -k identity\n-w /etc/security/opasswd -p wa -k identity\n-w /etc/group -p wa -k identity\n-w /etc/sudoers -p wa -k identity\n-w /etc/sudoers.d/ -p wa -k identity\n\nIf the command does not return all the lines above, or one or more of the lines are commented out, this is a finding.","fixText":"Log in to the HYCU VM console and load the STIG audit rules by using the following commands:\n\n1. cp /usr/share/audit/sample-rules/10-base-config.rules /usr/share/audit/sample-rules/30-stig.rules /usr/share/audit/sample-rules/31-privileged.rules /usr/share/audit/sample-rules/99-finalize.rules /etc/audit/rules.d/\n\n2. augenrules --load","ccis":["CCI-001403"]},{"vulnId":"V-268233","ruleId":"SV-268233r1038652_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must automatically audit account disabling actions.","description":"Account management ensures access to the network device is being controlled in a secure manner by granting access to only authorized personnel. Auditing account disabling actions will support account management procedures. When device management accounts are disabled, user or service accessibility may be affected. Auditing also ensures authorized active accounts remain enabled and available for use when required.","checkContent":"Verify the operating system must generate audit records for all account disabling events.\n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n# grep -E \"/etc/passwd|/etc/gshadow|/etc/shadow|/etc/security/opasswd|/etc/group|/etc/sudoers|/etc/sudoers.d/\" /etc/audit/audit.rules\n\n-w /etc/passwd -p wa -k identity\n-w /etc/gshadow -p wa -k identity\n-w /etc/shadow -p wa -k identity\n-w /etc/security/opasswd -p wa -k identity\n-w /etc/group -p wa -k identity\n-w /etc/sudoers -p wa -k identity\n-w /etc/sudoers.d/ -p wa -k identity\n\nIf the command does not return all the lines above, or one or more of the lines are commented out, this is a finding.","fixText":"Log in to the HYCU VM console and load the STIG audit rules by using the following commands:\n\n1. cp /usr/share/audit/sample-rules/10-base-config.rules /usr/share/audit/sample-rules/30-stig.rules /usr/share/audit/sample-rules/31-privileged.rules /usr/share/audit/sample-rules/99-finalize.rules /etc/audit/rules.d/\n\n2. augenrules --load","ccis":["CCI-001404"]},{"vulnId":"V-268234","ruleId":"SV-268234r1038654_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must automatically audit account removal actions.","description":"Account management, as a whole, ensures access to the network device is being controlled in a secure manner by granting access to only authorized personnel. Auditing account removal actions will support account management procedures. When device management accounts are terminated, user or service accessibility may be affected. Auditing also ensures authorized active accounts remain enabled and available for use when required.","checkContent":"Verify the operating system generates audit records for all account removal events.\n\nCheck the auditing rules in \"/etc/audit/audit.rules\" with the following command:\n# grep -E \"/etc/passwd|/etc/gshadow|/etc/shadow|/etc/security/opasswd|/etc/group|/etc/sudoers|/etc/sudoers.d/\" /etc/audit/audit.rules\n\n-w /etc/passwd -p wa -k identity\n-w /etc/gshadow -p wa -k identity\n-w /etc/shadow -p wa -k identity\n-w /etc/security/opasswd -p wa -k identity\n-w /etc/group -p wa -k identity\n-w /etc/sudoers -p wa -k identity\n-w /etc/sudoers.d/ -p wa -k identity\n\nIf the command does not return all the lines above, or one or more of the lines are commented out, this is a finding.","fixText":"Log in to the HYCU VM console and load the STIG audit rules by using the following commands:\n\n1. cp /usr/share/audit/sample-rules/10-base-config.rules /usr/share/audit/sample-rules/30-stig.rules /usr/share/audit/sample-rules/31-privileged.rules /usr/share/audit/sample-rules/99-finalize.rules /etc/audit/rules.d/\n\n2. augenrules --load","ccis":["CCI-001405"]},{"vulnId":"V-268235","ruleId":"SV-268235r1038742_rule","severity":"high","ruleTitle":"The HYCU virtual appliance must be configured to use DOD-approved online certificate status protocol (OCSP) responders or certificate revocation lists (CRLs) to validate certificates used for PKI-based authentication.","description":"Once issued by a DOD certificate authority (CA), public key infrastructure (PKI) certificates are typically valid for three years or shorter within the DOD. However, there are many reasons a certificate may become invalid before the prescribed expiration date. For example, an employee may leave or be terminated and still possess the smartcard on which the PKI certificates were stored. Another example is that a smartcard containing PKI certificates may become lost or stolen. A more serious issue could be that the CA or server which issued the PKI certificates has become compromised, thereby jeopardizing every certificate keypair that was issued by the CA. These examples of revocation use cases and many more can be researched further using internet cybersecurity resources.\n\nPKI user certificates presented as part of the identification and authentication criteria (e.g., DOD PKI as multifactor authentication [MFA]) must be checked for validity by network devices. For example, valid PKI certificates are digitally signed by a trusted DOD CA. Additionally, valid PKI certificates are not expired, and valid certificates have not been revoked by a DOD CA.\n\nNetwork devices can verify the validity of PKI certificates by checking with an authoritative CA. One method of checking the status of PKI certificates is to query databases referred to as certificate revocation lists (CRL). These are lists which are published, updated, and maintained by authoritative DOD CAs. For example, once certificates are expired or revoked, issuing CAs place the certificates on a CRL. Organizations can download these lists periodically (i.e., daily or weekly) and store them locally on the devices themselves or even onto another nearby local enclave resource. Storing them locally ensures revocation status can be checked even if internet connectivity is severed at the enclave's point of presence (PoP). However, CRLs can be rather large in storage size and further, the use of CRLs can be rather taxing on some computing resources.\n\nAnother method of validating certificate status is to use the OCSP. Using OCSP, a requestor (i.e., the network device which the user is trying to authenticate to) sends a request to an authoritative CA challenging the validity of a certificate that has been presented for identification and authentication. The CA receives the request and sends a digitally signed response indicating the status of the user's certificate as valid, revoked, or unknown. Network devices should only allow access for responses that indicate the certificates presented by the user were considered valid by an approved DOD CA. OCSP is the preferred method because it is fast, provides the most current status, and is lightweight. \n\nSatisfies: SRG-APP-000175-NDM-000262, SRG-APP-000177-NDM-000263, SRG-APP-000080-NDM-000220","checkContent":"Log in to the HYCU console and execute the following command:\nsudo cat /opt/grizzly/config.properties | grep \ncert.path.revocation.checking.enabled=true\n\nIf the variable is not set to true, this is a finding.","fixText":"OCSP revocation applies to all SSL communication done from HYCU Java application, including SMTP in SSL mode, LDAPS, and any HTTPS interaction (platform API servers, cloud targets, webhooks, etc.).\n\nTo enable OCSP revocation, log in to the HYCU console and edit the config file by executing the following command:\n  sudo vi /opt/grizzly/config.properties\n\nand add the following line:\n  cert.path.revocation.checking.enabled=true","ccis":["CCI-000185","CCI-000187","CCI-000764","CCI-000166"]},{"vulnId":"V-268236","ruleId":"SV-268236r1137887_rule","severity":"high","ruleTitle":"The HYCU virtual appliance must be configured to use at least two authentication servers for authenticating users prior to granting administration access.","description":"Centralized management of authentication settings increases the security of remote and nonlocal access methods. This control is particularly important protection against the insider threat. With robust centralized management, audit records for administrator account access to the organization's network devices can be more readily analyzed for trends and anomalies. The alternative method of defining administrator accounts on each device exposes the device configuration to remote access authentication attacks and system administrators with multiple authenticators for each network device.","checkContent":"Log in to the HYCU Web UI, select the gear menu, and then choose the Identity Providers option.\n\nVerify that two authentication servers are configured.\n\nIf no authentication server is configured or only a single server is configured, this is a finding.","fixText":"Log in to the HYCU Web UI, select the gear menu, and then choose the Identity Providers option.\n\nClick \"New\" to add an authentication server.\n\nConfigure two authentication servers on the Web UI.","ccis":["CCI-000370"]},{"vulnId":"V-268237","ruleId":"SV-268237r1038754_rule","severity":"high","ruleTitle":"The HYCU virtual appliance must be configured to use DOD PKI as multifactor authentication (MFA) for interactive logins.","description":"MFA is when two or more factors are used to confirm the identity of an individual who is requesting access to digital information resources. Valid factors include something the individual knows (e.g., username and password), something the individual has (e.g., a smartcard or token), or something the individual is (e.g., a fingerprint or biometric). Legacy information system environments only use a single factor for authentication, typically a username and password combination. Although two pieces of data are used in a username and password combination, this is still considered single factor because an attacker can obtain access simply by learning what the user knows. Common attacks against single-factor authentication are attacks on user passwords. These attacks include brute force password guessing, password spraying, and password credential stuffing. MFA, along with strong user account hygiene, helps mitigate against the threat of having account passwords discovered by an attacker. Even in the event of a password compromise, with MFA implemented and required for interactive login, the attacker still needs to acquire something the user has or replicate a piece of user's biometric digital presence.\n\nPrivate industry recognizes and uses a wide variety of MFA solutions. However, DOD public key infrastructure (PKI) is the only prescribed method approved for DOD organizations to implement MFA. For authentication purposes, centralized DOD certificate authorities (CA) issue PKI certificate key pairs (public and private) to individuals using the prescribed x.509 format. The private certificates that have been generated by the issuing CA are downloaded and saved to smartcards which, within DOD, are referred to as common access cards (CAC) or personal identity verification (PIV) cards. This happens at designated DOD badge facilities. The CA maintains a record of the corresponding public keys for use with PKI-enabled environments. Privileged user smartcards, or \"alternate tokens\", function in the same manner, so this requirement applies to all interactive user sessions (authorized and privileged users).\n\nNote: This requirement is used in conjunction with the use of a centralized authentication server (e.g., AAA, RADIUS, LDAP), which is a separate but equally important requirement. The MFA configuration of this requirement provides identification and the first phase of authentication (the challenge and validated response, thereby confirming the PKI certificate that was presented by the user). The centralized authentication server will provide the second phase of authentication (the digital presence of the PKI ID as a valid user in the requested security domain) and authorization. The centralized authentication server will map validated PKI identities to valid user accounts and determine access levels for authenticated users based on security group membership and role. In cases where the centralized authentication server is not used by the network device for user authorization, the network device must map the authenticated identity to the user account for PKI-based authentication.\n\nSatisfies: SRG-APP-000149-NDM-000247, SRG-APP-000820-NDM-000170, SRG-APP-000825-NDM-000180","checkContent":"Log in to the HYCU Web UI, select the gear menu, and then choose the Identity Providers option.\n\nVerify that at least one Identity Provider authentication server is configured. \n\nIf no Identity Provider is configured, this is a finding.\n\nWhen using certificate authentication using client certificate or smart card (CAC authentication), verify \"Enable Certificate Authentication\" is enabled. \n\nIf \"Enable Certification Authentication\" is not enabled, this is a finding.","fixText":"Configure Identity Provider authentication by adding one or more Identity Providers as authentication sources in HYCU. \n\nThis allows users to log in to the HYCU web user interface with their Identity Provider accounts or, if certificate authentication is enabled, with a client certificate or a smart card (CAC authentication).\n\nLog in to the HYCU Web UI, select the gear menu, and choose the \"Identity Providers\" option.\n\nConfigure Identity Provider by specifying the required setting. For example, if configuring Active Directory IDP, provide the domain and required LDAP URL to allow HYCU to use AD users and groups for access to the Web UI.\n\nWhen using certificate authentication using client certificate or smart card (CAC authentication), ensure \"Service Account\" is specified in the Active Directory configuration and \"Enable Certificate Authentication\" is enabled.","ccis":["CCI-000765","CCI-004046","CCI-004047"]},{"vulnId":"V-268238","ruleId":"SV-268238r1038665_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must generate audit records when successful/unsuccessful attempts to access privileges occur.","description":"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the information system (e.g., module or policy filter).","checkContent":"HYCU Web UI user access accounts cannot be edited, only removed and readded from/to user groups in the Web UI Self-Service menu.\n\nAfter adding a user to a group, log in to the HYCU Web UI, navigate into Events context, and search for message of category \"USER_GROUP\" and text \"Successfully added user to group\". If the message is not in Events, this is a finding.\n\nLog in to the VM console and run the following command:\nchkconfig auditd \n\nIf the Audit Service is not in a running state, this is a finding. \n\nCheck the contents of the \"/var/log/audit/audit.log\" file. Verify the operating system generates audit records when successful/unsuccessful attempts to access privileges occur. \n\nIf the audit log is not configured or does not have required contents, this is a finding.","fixText":"Configure the operating system to generate audit records when successful/unsuccessful attempts to access privileges occur.\n\nLog in to the HYCU VM console and run the following command:\nchkconfig auditd on\n\nLog in to the HYCU VM console and load the STIG audit rules by using the following commands:\n\n1. sudo cp /usr/share/audit/sample-rules/10-base-config.rules /usr/share/audit/sample-rules/30-stig.rules /usr/share/audit/sample-rules/31-privileged.rules /usr/share/audit/sample-rules/99-finalize.rules /etc/audit/rules.d/\n\n2. sudo augenrules --load","ccis":["CCI-000172"]},{"vulnId":"V-268239","ruleId":"SV-268239r1038771_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must generate audit records when successful/unsuccessful attempts to modify administrator privileges occur.","description":"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the network device (e.g., module or policy filter).","checkContent":"Check the contents of the \"/var/log/audit/audit.log\" file.\n\nHYCU also maintains Event (Audit) information in the \"HYCU Web UI Events\" menu. \n\nVerify the audit log contains records showing successful/unsuccessful attempts to modify or delete administrator privileges.\n\nIf the audit log is not configured or does not have required contents, this is a finding.","fixText":"Log in to the HYCU VM console and load the STIG audit rules by using the following commands:\n\n1. cp /usr/share/audit/sample-rules/10-base-config.rules /usr/share/audit/sample-rules/30-stig.rules /usr/share/audit/sample-rules/31-privileged.rules /usr/share/audit/sample-rules/99-finalize.rules /etc/audit/rules.d/\n\n2. augenrules --load","ccis":["CCI-000172"]},{"vulnId":"V-268240","ruleId":"SV-268240r1038772_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must generate audit records when successful/unsuccessful attempts to delete administrator privileges occur.","description":"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the network device (e.g., module or policy filter).","checkContent":"Check the contents of the \"/var/log/audit/audit.log\" file.\n\nHYCU also maintains Event (Audit) information in the \"HYCU Web UI Events\" menu.\n\nVerify the audit log contains records showing successful/unsuccessful attempts to modify or delete administrator privileges.\n\nIf the audit log is not configured or does not have required contents, this is a finding.","fixText":"Log in to the HYCU VM console and load the STIG audit rules by using the following commands:\n\n1. cp /usr/share/audit/sample-rules/10-base-config.rules /usr/share/audit/sample-rules/30-stig.rules /usr/share/audit/sample-rules/31-privileged.rules /usr/share/audit/sample-rules/99-finalize.rules /etc/audit/rules.d/\n\n2. augenrules --load","ccis":["CCI-000172"]},{"vulnId":"V-268241","ruleId":"SV-268241r1038672_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must generate audit records when successful/unsuccessful login attempts occur.","description":"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the network device (e.g., module or policy filter).","checkContent":"Check the contents of the \"/var/log/audit/audit.log\" file.\n\nVerify the audit log contains records showing when successful/unsuccessful login attempts occur.\n\nIf the audit log is not configured or does not have required contents, this is a finding.\n\nHYCU also maintains Event (Audit) information in the \"HYCU Web UI Events\" menu. Log in with correct and incorrect credentials and check the HYCU Events.\n\nIf the HYCU events of category \"SECURITY\" are not logged for each of the attempts, status is not \"Success\" for the correct credentials and status is not \"Warning\" for the incorrect credentials, this is a finding.","fixText":"Log in to the HYCU VM console and load the STIG audit rules by using the following commands:\n\n1. cp /usr/share/audit/sample-rules/10-base-config.rules /usr/share/audit/sample-rules/30-stig.rules /usr/share/audit/sample-rules/31-privileged.rules /usr/share/audit/sample-rules/99-finalize.rules /etc/audit/rules.d/\n\n2. augenrules --load","ccis":["CCI-000172"]},{"vulnId":"V-268242","ruleId":"SV-268242r1038675_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must generate audit records for privileged activities or other system-level access.","description":"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the network device (e.g., module or policy filter).","checkContent":"Log in to the VM console and run the following command:\nchkconfig auditd \n\nIf the Audit Service is not in a running state, this is a finding. \n\nAlso, if no logs are present in the \"/var/log/secure\" file, this is a finding.","fixText":"Audit logging is enabled by default within the HYCU VM console. If an administrator disabled it, reenable it by logging in to the HYCU VM console and running the following command:\nchkconfig auditd on\n\nUse the following command to review the logs:\ncat /var/log/secure | less \n\nUse the \"/\" character to search the log or timeframe for any undesired/unapproved changes.","ccis":["CCI-000172"]},{"vulnId":"V-268244","ruleId":"SV-268244r1038775_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must generate log records for a locally developed list of auditable events.","description":"Without generating audit records that are specific to the security and mission needs of the organization, it would be difficult to establish, correlate, and investigate the events relating to an incident or identify those responsible for one.\n\nAudit records can be generated from various components within the network device (e.g., module or policy filter).","checkContent":"Log in to the HYCU VM console. \n\nReview the /etc/audit/auditd.conf file and verify the settings are in accordance with a locally developed list of auditable events.\n\nIf it is not configured in accordance with organizational policies, this is a finding.\n\nCheck for the value of the \"max_log_file_action\" option in \"/etc/audit/auditd.conf\" with the following command:\nsudo grep max_log_file_action /etc/audit/auditd.conf\n\nIf the \"max_log_file_action\" value is not set to \"ROTATION\", this is a finding.","fixText":"Configure the operating system to use a locally developed list of auditable events by editing \"/etc/audit/auditd.conf\" files using the following command:\nsudo vi /etc/audit/auditd.conf\n\nAdd or modify lines to have the required values for the organization.","ccis":["CCI-000169","CCI-000366"]},{"vulnId":"V-268245","ruleId":"SV-268245r1038756_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must produce audit records containing information to establish when events occurred, where events occurred, the source of the event, the outcome of the event, and identity of any individual or process associated with the event.","description":"It is essential for security personnel to know what is being done, what was attempted, where it was done, when it was done, and by whom it was done to compile an accurate risk assessment. Logging the date and time of each detected event provides a means of investigating an attack; recognizing resource usage or capacity thresholds; or identifying an improperly configured network device. To establish and correlate the series of events leading up to an outage or attack, it is imperative the date and time are recorded in all log records. \n\nTo compile an accurate risk assessment and provide forensic analysis, it is essential for security personnel to know where events occurred, such as device hardware components, device software modules, session identifiers, filenames, host names, and functionality.\n\nTo compile an accurate risk assessment and provide forensic analysis, it is essential for security personnel to know the source of the event. The source may be a component, module, or process within the device or an external session, administrator, or device. \n\nWithout information about the outcome of events, security personnel cannot make an accurate assessment as to whether an attack was successful or if changes were made to the security state of the system.\n\nEvent outcomes can include indicators of event success or failure and event-specific results (e.g., the security state of the device after the event occurred). As such, they also provide a means to measure the impact of an event and help authorized personnel to determine the appropriate response.\n\nSatisfies: SRG-APP-000096-NDM-000226, SRG-APP-000097-NDM-000227, SRG-APP-000098-NDM-000228, SRG-APP-000099-NDM-000229, SRG-APP-000100-NDM-000230","checkContent":"Check the contents of the \"/var/log/audit/audit.log\" file.\n\nHYCU also maintains Event (Audit) information in the \"HYCU Web UI Events\" menu. \n\nVerify the audit log contains records for:\n- When (date and time) events occurred.\n- Where events occurred.\n- The source of the event(s).\n- The outcome of the event(s).\n- The identity of any individual or process associated with the event(s).\n\nIf the audit log is not configured or does not have required contents, this is a finding.","fixText":"Log in to the HYCU VM console and load the STIG audit rules by using the following commands:\n\n1. cp /usr/share/audit/sample-rules/10-base-config.rules /usr/share/audit/sample-rules/30-stig.rules /usr/share/audit/sample-rules/31-privileged.rules /usr/share/audit/sample-rules/99-finalize.rules /etc/audit/rules.d/\n\n2. augenrules --load","ccis":["CCI-000131","CCI-000132","CCI-000133","CCI-000134","CCI-001487"]},{"vulnId":"V-268246","ruleId":"SV-268246r1038438_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must generate audit records containing the full-text recording of privileged commands.","description":"Reconstruction of harmful events or forensic analysis is not possible if audit records do not contain enough information. \n\nOrganizations consider limiting the additional audit information to only that information explicitly needed for specific audit requirements. The additional information required is dependent on the type of information (i.e., sensitivity of the data and the environment within which it resides). At a minimum, the organization must audit full-text recording of privileged commands. The organization must maintain audit trails in sufficient detail to reconstruct events to determine the cause and impact of compromise.","checkContent":"Check if HYCU is configured to audit the execution of the \"execve\" system call, by running the following command:\n\n$ sudo grep execve /etc/audit/audit.rules\n\n-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv\n-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv\n\n-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv\n-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv\n\nIf the command does not return all lines, or the lines are commented out, this is a finding.","fixText":"Configure HYCU to audit the execution of the \"execve\" system call.\n\nAdd or update the following file system rules to \"/etc/audit/rules.d/audit.rules\":\n\n-a always,exit -F arch=b32 -S execve -C uid!=euid -F euid=0 -k execpriv\n-a always,exit -F arch=b64 -S execve -C uid!=euid -F euid=0 -k execpriv\n\n-a always,exit -F arch=b32 -S execve -C gid!=egid -F egid=0 -k execpriv\n-a always,exit -F arch=b64 -S execve -C gid!=egid -F egid=0 -k execpriv\n\nReboot the appliance to take effect.","ccis":["CCI-000135"]},{"vulnId":"V-268247","ruleId":"SV-268247r1038776_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must produce audit log records containing sufficient information to establish what type of event occurred.","description":"It is essential for security personnel to know what is being done, what was attempted, where it was done, when it was done, and by whom it was done to compile an accurate risk assessment. Associating event types with detected events in the application and audit logs provides a means of investigating an attack; recognizing resource usage or capacity thresholds; or identifying an improperly configured network device. Without this capability, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack.","checkContent":"Log in to the VM console and run the following command:\nchkconfig auditd \n\nIf the Audit Service is not in a running state, this is a finding. \n\nCheck the contents of the \"/var/log/audit/audit.log\" file.\n \nIf the audit log does not have the required contents, this is a finding.","fixText":"Audit logging is enabled by default within the HYCU VM console. If an administrator disabled it, reenable it by logging in to the HYCU VM console and running the following command:\nchkconfig auditd on\n\nUse the following command to review the logs:\ncat /var/log/secure | less  \n\nUse the \"/\" character to search the log or timeframe for any undesired/unapproved changes.\n\nLog in to the HYCU VM console and load the STIG audit rules by using the following commands: \n\n1. sudo cp /usr/share/audit/sample-rules/10-base-config.rules /usr/share/audit/sample-rules/30-stig.rules /usr/share/audit/sample-rules/31-privileged.rules /usr/share/audit/sample-rules/99-finalize.rules /etc/audit/rules.d/\n\n2. sudo augenrules --load","ccis":["CCI-000130"]},{"vulnId":"V-268248","ruleId":"SV-268248r1038777_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must initiate session auditing upon startup.","description":"It is essential for security personnel to know what is being done, what was attempted, where it was done, when it was done, and by whom it was done to compile an accurate risk assessment. Associating event types with detected events in the application and audit logs provides a means of investigating an attack; recognizing resource usage or capacity thresholds; or identifying an improperly configured network device. Without this capability, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. If auditing is enabled late in the startup process, the actions of some start-up processes may not be audited. Some audit systems also maintain state information only available if auditing is enabled before a given process is created.","checkContent":"Log in to the VM console and run the following command:\nchkconfig auditd \n\nIf the Audit Service is not in a running state, this is a finding. \n\nCheck the contents of the \"/var/log/audit/audit.log\" file.\n \nIf the audit log does not have the required contents, this is a finding.","fixText":"Audit logging is enabled by default within the HYCU VM console. If an administrator disabled it, reenable it by logging in to the HYCU VM console and running the following command:\nchkconfig auditd on\n\nUse the following command to review the logs:\ncat /var/log/secure | less  \n\nUse the \"/\" character to search the log or timeframe for any undesired/unapproved changes.\n\nLog in to the HYCU VM console and load the STIG audit rules by using the following commands: \n\n1. sudo cp /usr/share/audit/sample-rules/10-base-config.rules /usr/share/audit/sample-rules/30-stig.rules /usr/share/audit/sample-rules/31-privileged.rules /usr/share/audit/sample-rules/99-finalize.rules /etc/audit/rules.d/\n\n2. sudo augenrules --load","ccis":["CCI-001464"]},{"vulnId":"V-268249","ruleId":"SV-268249r1038778_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must automatically audit account enabling actions.","description":"It is essential for security personnel to know what is being done, what was attempted, where it was done, when it was done, and by whom it was done to compile an accurate risk assessment. Associating event types with detected events in the application and audit logs provides a means of investigating an attack; recognizing resource usage or capacity thresholds; or identifying an improperly configured network device. Without this capability, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. If auditing is enabled late in the startup process, the actions of some start-up processes may not be audited. Some audit systems also maintain state information only available if auditing is enabled before a given process is created.","checkContent":"Log in to the VM console and run the following command:\nchkconfig auditd \n\nIf the Audit Service is not in a running state, this is a finding. \n\nCheck the contents of the \"/var/log/audit/audit.log\" file.\n \nIf the audit log does not have the required contents, this is a finding.","fixText":"Audit logging is enabled by default within the HYCU VM console. If an administrator disabled it, reenable it by logging in to the HYCU VM console and running the following command:\nchkconfig auditd on\n\nUse the following command to review the logs:\ncat /var/log/secure | less  \n\nUse the \"/\" character to search the log or timeframe for any undesired/unapproved changes.\n\nLog in to the HYCU VM console and load the STIG audit rules by using the following commands: \n\n1. sudo cp /usr/share/audit/sample-rules/10-base-config.rules /usr/share/audit/sample-rules/30-stig.rules /usr/share/audit/sample-rules/31-privileged.rules /usr/share/audit/sample-rules/99-finalize.rules /etc/audit/rules.d/\n\n2. sudo augenrules --load","ccis":["CCI-002130"]},{"vulnId":"V-268250","ruleId":"SV-268250r1038779_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must generate audit records showing starting and ending time for administrator access to the system.","description":"It is essential for security personnel to know what is being done, what was attempted, where it was done, when it was done, and by whom it was done to compile an accurate risk assessment. Associating event types with detected events in the application and audit logs provides a means of investigating an attack; recognizing resource usage or capacity thresholds; or identifying an improperly configured network device. Without this capability, it would be difficult to establish, correlate, and investigate the events leading up to an outage or attack. If auditing is enabled late in the startup process, the actions of some start-up processes may not be audited. Some audit systems also maintain state information only available if auditing is enabled before a given process is created.","checkContent":"Log in to the VM console and run the following command:\nchkconfig auditd \n\nIf the Audit Service is not enabled, this is a finding. \n\nCheck the contents of the \"/var/log/audit/audit.log\" file.\n \nIf the audit log does not have the required contents, this is a finding.","fixText":"Audit logging is enabled by default within the HYCU VM console. If an administrator disabled it, reenable it by logging in to the HYCU VM console and running the following commands:\nchkconfig auditd on\nsystemctl start auditd\n\nUse the following command to review the logs:\ncat /var/log/secure | less  \n\nUse the \"/\" character to search the log or timeframe for any undesired/unapproved changes.\n\nLog in to the HYCU VM console and load the STIG audit rules by using the following commands: \n\n1. sudo cp /usr/share/audit/sample-rules/10-base-config.rules /usr/share/audit/sample-rules/30-stig.rules /usr/share/audit/sample-rules/31-privileged.rules /usr/share/audit/sample-rules/99-finalize.rules /etc/audit/rules.d/\n\n2. sudo augenrules --load","ccis":["CCI-000172"]},{"vulnId":"V-268251","ruleId":"SV-268251r1038695_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must allocate audit record storage capacity in accordance with organization-defined audit record storage requirements.","description":"To ensure network devices have a sufficient storage capacity in which to write the audit logs, they must be able to allocate audit record storage capacity. The task of allocating audit record storage capacity is usually performed during initial device setup if it can be modified.","checkContent":"Log in to the HYCU VM console. \n\nReview the /etc/audit/auditd.conf file and verify that the settings are in accordance with organizational policies.\n\nIf it is not configured in accordance with organizational policies, this is a finding.\n\nCheck for the value of the \"max_log_file_action\" option in \"/etc/audit/auditd.conf\" with the following command:\nsudo grep max_log_file_action /etc/audit/auditd.conf\n\nIf the \"max_log_file_action\" value is not set to \"ROTATION\", this is a finding.","fixText":"Configure the operating system to enforce log rotation and restrict log file size to an organization-defined value by editing \"/etc/audit/auditd.conf\" files using the following command:\nsudo vi /etc/audit/auditd.conf\n\nAdd or modify the following lines to have the required value for the organization. Refer to the sample below:\nmax_log_file_action = ROTATION\nmax_log_file = 6","ccis":["CCI-001849"]},{"vulnId":"V-268252","ruleId":"SV-268252r1038698_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must support organizational requirements to conduct backups of information system documentation, including security-related documentation, when changes occur or weekly, whichever is sooner.","description":"Information system backup is a critical step in maintaining data assurance and availability. Information system and security-related documentation contains information pertaining to system configuration and security settings. If this information were not backed up, and a system failure were to occur, the security settings would be difficult to reconfigure quickly and accurately. Maintaining a backup of information system and security-related documentation provides for a quicker recovery time when system outages occur.\n\nSystem-level information includes default and customized settings and security attributes, including ACLs that relate to the network device configuration, as well as software required for the execution and operation of the device. Information system backup is a critical step in ensuring system integrity and availability. If the system fails and there is no backup of the system-level information, a denial-of-service condition is possible for all who use this critical network component.\n\nInformation stored in one location is vulnerable to accidental or incidental deletion or alteration.\n\nOffloading is a common process in information systems with limited audit storage capacity.","checkContent":"Verify that HYCU is backing itself up by logging in to the HYCU Web UI and checking the HYCU Controller widget at the HYCU Dashboard. \n\nIf the message \"Controller VM is not protected\" is found and highlighted in orange, this is a finding.","fixText":"Log in to the HYCU Web UI and go to the \"Virtual Machines\" menu, then apply a backup policy to the HYCU Server to back it up. \n\nAny documentation/configuration files stored on the HYCU server will be backed up as a result.","ccis":["CCI-000539","CCI-000366"]},{"vulnId":"V-268253","ruleId":"SV-268253r1038701_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must off-load audit records onto a different system or media than the system being audited.","description":"Information system backup is a critical step in maintaining data assurance and availability. Information system and security-related documentation contains information pertaining to system configuration and security settings. If this information were not backed up and a system failure were to occur, the security settings would be difficult to reconfigure quickly and accurately. Maintaining a backup of information system and security-related documentation provides for a quicker recovery time when system outages occur.\n\nSystem-level information includes default and customized settings and security attributes, including ACLs that relate to the network device configuration, as well as software required for the execution and operation of the device. Information system backup is a critical step in ensuring system integrity and availability. If the system fails and there is no backup of the system-level information, a denial-of-service condition is possible for all who use this critical network component.\n\nInformation stored in one location is vulnerable to accidental or incidental deletion or alteration.\n\nOffloading is a common process in information systems with limited audit storage capacity.\n\nSatisfies: SRG-APP-000515-NDM-000325, SRG-APP-000516-NDM-000340","checkContent":"Verify that HYCU is backing itself up by logging in to the HYCU Web UI and checking the HYCU Controller widget at the HYCU Dashboard. \n\nIf the message \"Controller VM is not protected\" is found and highlighted in orange, this is a finding.","fixText":"Log in to the HYCU Web UI and go to the \"Virtual Machines\" menu, then apply a backup policy to the HYCU Server to back it up. \n\nAny documentation/configuration files stored on the HYCU server will be backed up as a result.","ccis":["CCI-001851","CCI-000366","CCI-000537"]},{"vulnId":"V-268254","ruleId":"SV-268254r1038704_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must generate an immediate real-time alert of all audit failure events requiring real-time alerts.","description":"It is critical for the appropriate personnel to be aware if a system is at risk of failing to process audit logs as required. Without a real-time alert, security personnel may be unaware of an impending failure of the audit capability and system operation may be adversely affected.\n\nSatisfies: SRG-APP-000360-NDM-000295, SRG-APP-000795-NDM-000130","checkContent":"Log in to the HYCU Web UI and review the \"Events\" menu and \"Email Notifications\" to verify that all appropriate/relevant audit failure events are included in the \"Category\" drop-down menu. \n\nIf these events are not shown (reference a recent event capturing a login to HYCU for validation), this is a finding.","fixText":"Log in to the HYCU Web UI and go to the \"Events\" menu and open \"Email Notifications\".\n \nEnsure that all the appropriate/relevant categories are selected and that the \"Status\" includes failures.\n \nAdd a \"Subject\" for the \"Email Notifications\" and email address for necessary auditors or HYCU administrators.","ccis":["CCI-001858","CCI-003831"]},{"vulnId":"V-268255","ruleId":"SV-268255r1039643_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must protect audit information from unauthorized deletion.","description":"Audit information includes all information (e.g., audit records, audit settings, and audit reports) needed to successfully audit information system activity.\n\nIf audit data were to become compromised, then forensic analysis and discovery of the true source of potentially malicious system activity is impossible to achieve. \n\nTo ensure the veracity of audit data, the network device must protect audit information from unauthorized deletion. This requirement can be achieved through multiple methods, which will depend upon system architecture and design. Some commonly employed methods include ensuring log files receive the proper file system permissions using file system protections, restricting access, and backing up log data to ensure log data is retained. \n\nNetwork devices providing a user interface to audit data will leverage user permissions and roles identifying the user accessing the data and the corresponding rights the user enjoys to make access decisions regarding the deletion of audit data.","checkContent":"Verify the operating system audit records have proper permissions and ownership.\n\nLog in to the HYCU console and list the full permissions and ownership of the audit log files with the following command:\n# sudo ls -la /var/log/audit\ntotal 4512\ndrwx------. 2 root root 23 Apr 25 16:53 .\ndrwxr-xr-x. 17 root root 4096 Aug 9 13:09 ..\n-rw-------. 1 root root 8675309 Aug 9 12:54 audit.log\n\nAudit logs must be mode 0600 or less permissive. If any are more permissive, this is a finding.\n\nThe owner and group owner of all audit log files must both be \"root\". If any other owner or group owner is listed, this is a finding.","fixText":"Change the mode of the audit log files with the following command:\n# chmod 0600 [audit_file]\n\nChange the owner and group owner of the audit log files with the following command:\n# chown root:root [audit_file]","ccis":["CCI-000164"]},{"vulnId":"V-268256","ruleId":"SV-268256r1038708_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must protect audit tools from unauthorized access, modification, and deletion.","description":"Protecting audit data also includes identifying and protecting the tools used to view and manipulate log data. Therefore, protecting audit tools is necessary to prevent unauthorized operation on audit data.\n\nNetwork devices providing tools to interface with audit data will leverage user permissions and roles identifying the user accessing the tools and the corresponding rights the user enjoys to make access decisions regarding the access to audit tools.\n\nAudit tools include, but are not limited to, vendor-provided and open source audit tools needed to successfully view and manipulate audit information system activity and records. Audit tools include custom queries and report generators.\n\nSatisfies: SRG-APP-000121-NDM-000238, SRG-APP-000122-NDM-000239, SRG-APP-000123-NDM-000240","checkContent":"Verify the operating system audit tools and config files have proper permissions and ownership.\n\nLog in to the HYCU console and list the full permissions and ownership of the audit folder with the following command:\nsudo ls  -al /etc/audit\n\nFolder and files must be owned by root and the following permissions must be set: \ndrwxr-x---.   4 root root  126 Mar 15 10:16 .\ndrwxr-xr-x. 106 root root 8192 May  6 13:58 ..\n-rw-r-----.   1 root root  751 Apr 24  2020 audisp-remote.conf\n-rw-r-----.   1 root root  856 Apr 24  2020 auditd.conf\n-rw-r-----.   1 root root  107 Feb  3 13:18 audit.rules\n-rw-r-----.   1 root root  127 Apr 24  2020 audit-stop.rules\ndrwxr-x---.   2 root root   67 Mar 15 10:16 plugins.d\ndrwxr-x---.   2 root root   25 Feb  3 13:13 rules.d\n\nAudit files must be mode 0640 or less permissive. If any are more permissive, this is a finding.\n\nThe owner and group owner of all audit files must both be \"root\". If any other owner or group owner is listed, this is a finding.","fixText":"Change the mode of the audit log files with the following command:\n# chmod 0640 [audit_file]\n\nChange the owner and group owner of the audit files with the following command:\n# chown root:root [audit_file]","ccis":["CCI-001493","CCI-001494","CCI-001495"]},{"vulnId":"V-268257","ruleId":"SV-268257r1038710_rule","severity":"high","ruleTitle":"The HYCU virtual appliance must be running a release that is currently supported by the vendor.","description":"Network devices running an unsupported operating system lack current security fixes required to mitigate the risks associated with recent vulnerabilities.","checkContent":"Verify that the HYCU device is running a supported version.\n\nLog in to the HYCU Web UI. On the menu on the left side of the page, scroll to the bottom, where it shows the running version of HYCU.\n\nIf HYCU version is not on the list of supported versions, as specified in the End-of-Life Milestones and Dates, this is a finding.\n\nNote: The HYCU support portal specifies the HYCU end of life policies. To determine if the system is using a supported version, visit: https://download.hycu.com/docs/HYCU-EOL-dates.pdf.","fixText":"Perform upgrade to the supported HYCU version following upgrade section of user manual.","ccis":["CCI-000366"]},{"vulnId":"V-268258","ruleId":"SV-268258r1039645_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must obtain its public key certificates from an appropriate certificate policy through an approved service provider.","description":"For user certificates, each organization obtains certificates from an approved, shared service provider, as required by OMB policy. For federal agencies operating a legacy public key infrastructure cross-certified with the Federal Bridge Certification Authority at medium assurance or higher, this Certification Authority will suffice.\n\nSatisfies: SRG-APP-000516-NDM-000344, SRG-APP-000910-NDM-000300","checkContent":"Open a new HYCU Web UI browser tab and verify there is no warning prompt before proceeding to the Web UI login page. \n\nIf a warning appears in the web browser stating, \"Not secure\", this is a finding.","fixText":"Log in to the HYCU Web UI and generate a CSR within the gear menu and \"SSL Certificates\" menu.\n \nSubmit this CSR to a DOD PKI authority to have a new certificate created. \n\nNote: By default, HYCU is configured with a self-signed certificate, but this can be replaced with a DOD-issued certificate. This certificate can be configured by logging in to the HYCU Web UI, navigating to the gear menu and \"SSL Certificates\" menu, and importing the DOD-issued certificate.","ccis":["CCI-000366","CCI-001159","CCI-004909"]},{"vulnId":"V-268259","ruleId":"SV-268259r1043177_rule","severity":"high","ruleTitle":"The HYCU virtual appliance must be configured to prohibit the use of all unnecessary and/or nonsecure functions, ports, protocols, and/or services.","description":"To prevent unauthorized connection of devices, unauthorized transfer of information, or unauthorized tunneling (i.e., embedding of data types within data types), organizations must disable unused or unnecessary physical and logical ports/protocols on information systems.\n\nNetwork devices are capable of providing a wide variety of functions and services. Some of the functions and services provided by default may not be necessary to support essential organizational operations. Additionally, it is sometimes convenient to provide multiple services from a single component (e.g., email and web services); however, doing so increases risk over limiting the services provided by any one component. \n\nTo support the requirements and principles of least functionality, the network device must support the organizational requirements providing only essential capabilities and limiting the use of ports, protocols, and/or services to only those required, authorized, and approved. Some network devices have capabilities enabled by default; if these capabilities are not necessary, they must be disabled. If a particular capability is used, then it must be documented and approved.","checkContent":"Verify the SSHD daemon has been disabled using the following command:\n$ sudo systemctl status sshd\n\nLoaded: loaded (/usr/lib/systemd/system/sshd.service; disabled)\n\nActive: inactive (dead)\n\nIf the SSHD daemon is not disabled and inactive or is not documented and approved for use, this is a finding.","fixText":"Stop the SSHD daemon using the following command:\n$ sudo systemctl stop sshd\n\nDisable the SSHD daemon using the following command:\n$ sudo systemctl disable sshd\n\nNote: The service must be stopped before it can be disabled.","ccis":["CCI-000382"]},{"vulnId":"V-268260","ruleId":"SV-268260r1038716_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must implement replay-resistant authentication mechanisms for network access to privileged accounts.","description":"A replay attack may enable an unauthorized user to gain access to the application. Authentication sessions between the authenticator and the application validating the user credentials must not be vulnerable to a replay attack.\n\nAn authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message. \n\nTechniques used to address this include protocols using nonces (e.g., numbers generated for a specific one-time use) or challenges (e.g., TLS, WS_Security). Additional techniques include time-synchronous or challenge-response one-time authenticators.","checkContent":"The use of SSH-2 protocol for network/remote access prevents replay attacks. The SSH-2 protocol is the standard for the SSH daemon in the Linux OS used by HYCU.\n\nTo determine the SSH version in use, log in to the HYCU console and execute the following command:\nssh -v localhost\n\nIf the output does not show remote protocol version 2.0 in use, this is a finding.\n\nHYCU web access uses TLS, which addresses this threat. HYCU web access cannot be configured to not use TLS.","fixText":"Log in to the HYCU console and configure SSH to use the SSH-2 protocol by editing the protocol variable in the file \"/etc/ssh/sshd_config\".","ccis":["CCI-001941"]},{"vulnId":"V-268262","ruleId":"SV-268262r1038718_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must enforce password complexity by requiring that at least one uppercase character be used.","description":"Use of a complex passwords helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor of several that determine how long it takes to crack a password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised.\n\nMultifactor authentication (MFA) is required for all administrative and user accounts on network devices, except for an account of last resort and (where applicable) a root account. Passwords should only be used when MFA using PKI is not available, and for the account of last resort and root account.","checkContent":"Log in to the HYCU VM console. Check for the value of the \"minclass\" option in \"/etc/security/pwquality.conf\" with the following command:\ngrep minclass /etc/security/pwquality.conf \n\nIf the minclass value is not set to \"5\", this is a finding.","fixText":"Configure the operating system to enforce a minimum class setting.\n\nAdd the following line to \"/etc/security/pwquality.conf\" (or modify the line to have the required value):\nminclass = 5","ccis":["CCI-004066"]},{"vulnId":"V-268263","ruleId":"SV-268263r1038720_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must enforce password complexity by requiring that at least one lowercase character be used.","description":"Use of a complex passwords helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor of several that determine how long it takes to crack a password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised.\n\nMultifactor authentication (MFA) is required for all administrative and user accounts on network devices, except for an account of last resort and (where applicable) a root account. Passwords should only be used when MFA using PKI is not available, and for the account of last resort and root account.","checkContent":"Log in to the HYCU VM console. Check for the value of the \"minclass\" option in \"/etc/security/pwquality.conf\" with the following command:\ngrep minclass /etc/security/pwquality.conf \n\nIf the minclass value is not set to \"5\", this is a finding.","fixText":"Configure the operating system to enforce a minimum class setting.\n\nAdd the following line to \"/etc/security/pwquality.conf\" (or modify the line to have the required value):\nminclass = 5","ccis":["CCI-004066"]},{"vulnId":"V-268264","ruleId":"SV-268264r1038722_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must enforce password complexity by requiring that at least one numeric character be used.","description":"Use of a complex passwords helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor of several that determine how long it takes to crack a password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised.\n\nMultifactor authentication (MFA) is required for all administrative and user accounts on network devices, except for an account of last resort and (where applicable) a root account. Passwords should only be used when MFA using PKI is not available, and for the account of last resort and root account.","checkContent":"Log in to the HYCU VM console. Check for the value of the \"minclass\" option in \"/etc/security/pwquality.conf\" with the following command:\ngrep minclass /etc/security/pwquality.conf \n\nIf the minclass value is not set to \"5\", this is a finding.","fixText":"Configure the operating system to enforce a minimum class setting.\n\nAdd the following line to \"/etc/security/pwquality.conf\" (or modify the line to have the required value):\nminclass = 5","ccis":["CCI-004066"]},{"vulnId":"V-268265","ruleId":"SV-268265r1038724_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must enforce password complexity by requiring that at least one special character be used.","description":"Use of a complex passwords helps to increase the time and resources required to compromise the password. Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks.\n\nPassword complexity is one factor of several that determine how long it takes to crack a password. The more complex the password is, the greater the number of possible combinations that need to be tested before the password is compromised.\n\nMultifactor authentication (MFA) is required for all administrative and user accounts on network devices, except for an account of last resort and (where applicable) a root account. Passwords should only be used when MFA using PKI is not available, and for the account of last resort and root account.","checkContent":"Log in to the HYCU VM console. Check for the value of the \"minclass\" option in \"/etc/security/pwquality.conf\" with the following command:\ngrep minclass /etc/security/pwquality.conf \n\nIf the minclass value is not set to \"5\", this is a finding.","fixText":"Configure the operating system to enforce a minimum class setting.\n\nAdd the following line to \"/etc/security/pwquality.conf\" (or modify the line to have the required value):\nminclass = 5","ccis":["CCI-004066"]},{"vulnId":"V-268266","ruleId":"SV-268266r1038758_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must enforce a minimum 15-character password length.","description":"Password complexity, or strength, is a measure of the effectiveness of a password in resisting attempts at guessing and brute-force attacks. Password length is one factor of several that helps to determine strength and how long it takes to crack a password.\n\nThe shorter the password, the lower the number of possible combinations that need to be tested before the password is compromised. Use of more characters in a password helps to exponentially increase the time and/or resources required to compromise the password.","checkContent":"Check for the value of the \"minlen\" option in \"/etc/security/pwquality.conf\" with the following command:\ngrep minlen /etc/security/pwquality.conf \n\nIf the minlen value is not set to \"15\", this is a finding.\n\nCheck for the value of the \"user.password.min.length\" variable in \"/opt/grizzly/config.properties\" HYCU configuration file with the following command:\ngrep user.password.min.length /opt/grizzly/config.properties\n\nIf the value is not set to 15 or more, this is a finding.","fixText":"Add the following line to \"/etc/security/pwquality.conf\" (or modify the line to have the required value).\nminlen = 15\n\nAdd or modify the following line in the /opt/grizzly/config.properties configuration file:\nuser.password.min.length=15\n\nReload the HYCU application by running the following command:\nsudo systemctl reload grizzly","ccis":["CCI-004066"]},{"vulnId":"V-268267","ruleId":"SV-268267r1043189_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must require that when a password is changed, the characters are changed in at least eight of the positions within the password.","description":"If the application allows the user to consecutively reuse extensive portions of passwords, this increases the chances of password compromise by increasing the window of opportunity for attempts at guessing and brute-force attacks.\n\nThe number of changed characters refers to the number of changes required with respect to the total number of positions in the current password. In other words, characters may be the same within the two passwords; however, the positions of the like characters must be different.\n\nMultifactor authentication (MFA) is required for all administrative and user accounts on network devices, except for an account of last resort and (where applicable) a root account. Passwords should only be used when MFA using PKI is not available, and for the account of last resort and root account.","checkContent":"Verify the value of the \"difok\" option with the following command:\n$ sudo grep -r difok /etc/security/pwquality.conf*\n\n/etc/security/pwquality.conf:difok = 8\n\nIf the value of \"difok\" is set to less than \"8\" or is commented out, this is a finding.\n\nIf conflicting results are returned, this is a finding.","fixText":"Configure the operating system to require the change of at least eight of the total number of characters when passwords are changed by setting the \"difok\" option.\n\nAdd the following line to \"/etc/security/pwquality.conf\" (or modify the line to have the required value):\ndifok = 8\n\nRemove any configurations that conflict with the above value.","ccis":["CCI-004066"]},{"vulnId":"V-268269","ruleId":"SV-268269r1038744_rule","severity":"high","ruleTitle":"The HYCU virtual appliance must use FIPS 140-2-approved algorithms for authentication to a cryptographic module.","description":"Unapproved mechanisms that are used for authentication to the cryptographic module are not validated and therefore cannot be relied upon to provide confidentiality or integrity, and DOD data may be compromised.\n\nNetwork devices utilizing encryption are required to use FIPS-compliant mechanisms for authenticating to cryptographic modules.\n\nFIPS 140-2 is the current standard for validating that mechanisms used to access cryptographic modules utilize authentication that meets DOD requirements. However, authentication algorithms must configure security processes to use only FIPS-approved and NIST-recommended authentication algorithms.","checkContent":"When FIPS mode is enabled, the HYCU application will use FIPS-compliant behavior. Validate the FIPS status using the following command:\n'cat /proc/sys/crypto/fips_enabled' \n\nIf command output does not show \"1\", this is a finding.\n\n'fips-mode-setup --check'\n\nIf command output does not show \"FIPS mode is enabled\", this is a finding.\n\n'update-crypto-policies --show'\n\nIf command output does not show \"FIPS\", this is a finding.","fixText":"Stop the HYCU web server: \nsudo systemctl stop grizzly.service\n\nEnable FIPS-compliant mode: \nsudo /opt/grizzly/bin/enable_fips.sh\n\nReboot the HYCU virtual machines:\nshutdown -r now","ccis":["CCI-000803"]},{"vulnId":"V-268270","ruleId":"SV-268270r1038745_rule","severity":"high","ruleTitle":"The HYCU virtual appliance must use FIPS-validated Keyed-Hash Message Authentication Code (HMAC) to protect the integrity of nonlocal maintenance and diagnostic communications.","description":"Unapproved mechanisms that are used for authentication to the cryptographic module are not verified and therefore cannot be relied on to provide confidentiality or integrity, and DOD data may be compromised.\n\nNonlocal maintenance and diagnostic activities are those activities conducted by individuals communicating through a network, either an external network (e.g., the internet) or an internal network. \n\nCurrently, HMAC is the only FIPS-approved algorithm for generating and verifying message/data authentication codes in accordance with FIPS 198-1. Products that are FIPS 140-2-validated will have an HMAC that meets specification; however, the option must be configured for use as the only message authentication code used for authentication to cryptographic modules.\n\nSeparate requirements for configuring applications and protocols used by each application (e.g., SNMPv3, SSHv2, NTP, HTTPS, and other protocols and applications that require server/client authentication) are required to implement this requirement. Where SSH is used, the SSHv2 protocol suite is required because it includes Layer 7 protocols such as SCP and SFTP, which can be used for secure file transfers.","checkContent":"When FIPS mode is enabled, the HYCU application will use FIPS-compliant behavior. Validate the FIPS status using the following command:\n'cat /proc/sys/crypto/fips_enabled' \n\nIf command output does not show \"1\", this is a finding.\n\n'fips-mode-setup --check'\n\nIf command output does not show \"FIPS mode is enabled\", this is a finding.\n\n'update-crypto-policies --show'\n\nIf command output does not show \"FIPS\", this is a finding.","fixText":"Stop the HYCU web server: \nsudo systemctl stop grizzly.service\n\nEnable FIPS-compliant mode: \nsudo /opt/grizzly/bin/enable_fips.sh\n\nReboot the HYCU virtual appliance:\nshutdown -r now","ccis":["CCI-002890"]},{"vulnId":"V-268271","ruleId":"SV-268271r1038746_rule","severity":"high","ruleTitle":"The HYCU virtual appliance must be configured to implement cryptographic mechanisms using a FIPS 140-2-approved algorithm to protect the confidentiality of remote maintenance sessions.","description":"This requires the use of secure protocols instead of their unsecured counterparts, such as SSH instead of telnet, SCP instead of FTP, and HTTPS instead of HTTP. If unsecured protocols (lacking cryptographic mechanisms) are used for sessions, the contents of those sessions will be susceptible to eavesdropping, potentially putting sensitive data (including administrator passwords) at risk of compromise and potentially allowing hijacking of maintenance sessions.","checkContent":"When FIPS mode is enabled, the HYCU application will use FIPS-compliant behavior. Validation of FIPS status can be done using the following commands:\n'cat /proc/sys/crypto/fips_enabled' \n\nIf command output does not show \"1\", this is a finding.\n\n'fips-mode-setup --check'\n\nIf command output does not show \"FIPS mode is enabled\", this is a finding.\n\n'update-crypto-policies --show'\n\nIf command output does not show \"FIPS\", this is a finding.","fixText":"Stop the HYCU web server: \nsudo systemctl stop grizzly.service\n\nEnable FIPS-compliant mode: \nsudo /opt/grizzly/bin/enable_fips.sh\n\nReboot the HYCU virtual appliance:\nshutdown -r now","ccis":["CCI-003123"]},{"vulnId":"V-268274","ruleId":"SV-268274r1051115_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must be configured with only one local account to be used as the account of last resort in the event the authentication server is unavailable.","description":"Authentication for administrative (privileged level) access to the device is required at all times. An account can be created on the device's local database for use when the authentication server is down or connectivity between the device and the authentication server is not operable. This account is referred to as the account of last resort since it is intended to be used as a last resort and when immediate administrative access is absolutely necessary.","checkContent":"Log in to HYCU UI and ensure that admin user is the only user configured with HYCU Authentication type. If any other user except for built-in admin is configured with HYCU Authentication type, this is a finding.\n\nLog in to HYCU console, run the command \"cat /etc/passwd\" within the HYCU console and ensure no nondefault user account configured. If any other user apart from HYCU user is configured to access HYCU console, this is a finding.","fixText":"Log in to the HYCU Web UI, select Self-Service on the left menu. Then select Manage Users.\n\nDelete all users configured with HYCU Authentication type except from the built-in admin user.\n\nTo check for any unauthorized users on the VM Console, run the following command: \ncat /etc/passwd\n\nUse the \"userdel\" command to remove any unauthorized users.","ccis":["CCI-001358","CCI-002111"]},{"vulnId":"V-268282","ruleId":"SV-268282r1038736_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must audit the enforcement actions used to restrict access associated with changes to the device.","description":"Without auditing the enforcement of access restrictions against changes to the device configuration, it will be difficult to identify attempted attacks, and an audit trail will not be available for forensic investigation for after-the-fact actions. \n\nEnforcement actions are the methods or mechanisms used to prevent unauthorized changes to configuration settings. Enforcement action methods may be as simple as denying access to a file based on the application of file permissions (access restriction). Audit items may consist of lists of actions blocked by access restrictions or changes identified after the fact.","checkContent":"Check the contents of the \"/var/log/audit/audit.log\" file.\n\nVerify the audit log contains records showing when unsuccessful login attempts occur.\n\nIf the audit log is not configured or does not have required contents, this is a finding.\n\nHYCU also maintains Event (Audit) information in the \"HYCU Web UI Events\" menu. Log in with incorrect credentials and check the HYCU Events.\n\nIf the HYCU event of category \"SECURITY\" and status \"Warning\" is not logged, this is a finding.","fixText":"Log in to the HYCU VM console and load the STIG audit rules by using the following commands:\n\n1. cp /usr/share/audit/sample-rules/10-base-config.rules /usr/share/audit/sample-rules/30-stig.rules /usr/share/audit/sample-rules/31-privileged.rules /usr/share/audit/sample-rules/99-finalize.rules /etc/audit/rules.d/\n\n2. augenrules --load","ccis":["CCI-003938"]},{"vulnId":"V-268283","ruleId":"SV-268283r1038766_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must prevent the installation of patches, service packs, or application components without verification the software component has been digitally signed using a certificate that is recognized and approved by the organization.","description":"Changes to any software components can have significant effects on the overall security of the network device. Verifying software components have been digitally signed using a certificate that is recognized and approved by the organization ensures the software has not been tampered with and has been provided by a trusted vendor.\n\nAccordingly, patches, service packs, or application components must be signed with a certificate recognized and approved by the organization.\n\nVerifying the authenticity of the software prior to installation validates the integrity of the patch or upgrade received from a vendor. This ensures the software has not been tampered with and has been provided by a trusted vendor. Self-signed certificates are disallowed by this requirement. The device should not have to verify the software again. This requirement does not mandate DOD certificates for this purpose; however, the certificate used to verify the software must be from an approved CA.","checkContent":"Verify the operating system prevents the installation of patches, service packs, device drivers, or operating system components from a repository without verification that they have been digitally signed using a certificate that is recognized and approved by the organization.\n\nCheck that YUM verifies the signature of packages from a repository prior to install with the following command:\n\n$ sudo grep -E '^\\[.*\\]|gpgcheck' /etc/yum.repos.d/*.repo\n\n/etc/yum.repos.d/appstream.repo:[appstream]\n/etc/yum.repos.d/appstream.repo:gpgcheck=1\n/etc/yum.repos.d/baseos.repo:[baseos]\n/etc/yum.repos.d/baseos.repo:gpgcheck=1\n\nIf \"gpgcheck\" is not set to \"1\", or if options are missing or commented out, this is a finding.\n\nExecute the following command to check the kernel and cryptographic libraries, as well as the SHA256 checksums of the application files:\n$ sudo /opt/grizzly/bin/hycu-selftest.sh\n\nIf the output is not OK for the OS, this is a finding.\n\nIf the output reports an error for any other file than /etc/issue for the App section, this is a finding.","fixText":"Configure the operating system to verify the signature of packages from a repository prior to install by setting the following option in every repo file in /etc/yum.repos.d/:\ngpgcheck=1\n\nCheck the output of \"sudo /opt/grizzly/bin/hycu-selftest.sh\".\n\nInvestigate each file listed in the error output to determine a fix.","ccis":["CCI-003992"]},{"vulnId":"V-268296","ruleId":"SV-268296r1137881_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must install security-relevant software updates within the time period directed by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).","description":"Security flaws with software are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates. Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously. \n\nOrganization-defined time periods for updating security-relevant software may vary based on a variety of factors including, for example, the security category of the information system or the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw). \n\nThis requirement will apply to software patch management solutions that are used to install software patches across the enclave (e.g., mobile device management solutions). Patch criticality, as well as system criticality will vary. Therefore, the tactical situations regarding the patch management process will also vary. This means that the time period used must be a configurable parameter. Time frames for application of security-relevant software updates may be dependent upon the Information Assurance Vulnerability Management (IAVM) process.\n\nThe application will be configured to check for and install security-relevant software updates within an identified time period from the availability of the update. The specific time period will be defined by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).","checkContent":"Obtain evidence that software updates are consistently applied to the HYCU virtual appliance within the time frame defined for each patch.\n\nIf such evidence cannot be obtained, or the evidence obtained indicates a pattern of noncompliance, this is a finding.\n\nIf the HYCU virtual appliance does not install security-relevant updates within the time period directed by the authoritative source, this is a finding.","fixText":"Institute and adhere to policies and procedures to ensure that patches are consistently applied to the HYCU virtual appliance within the time allowed.","ccis":["CCI-002605"]},{"vulnId":"V-268301","ruleId":"SV-268301r1195282_rule","severity":"high","ruleTitle":"The HYCU virtual appliance must terminate all network connections associated with a device management session at the end of the session, or the session must be terminated after five minutes of inactivity except to fulfill documented and validated mission requirements.","description":"Terminating an idle session within a short time period reduces the window of opportunity for unauthorized personnel to take control of a management session enabled on the console or console port that has been left unattended. In addition, quickly terminating an idle session will also free up resources committed by the managed network element.","checkContent":"Log in to the HYCU VM console. For console connections, check for the value of the \"TMOUT\" option in \"/home/hycu/.bashrc\" with the following command:\ngrep TMOUT /home/hycu/.bashrc\n\nIf the \"TMOUT\" value is not set to \"300\" or less, this is a finding.\n\nFor SSH connections, check for the value of the \"ClientAliveInterval\" option in \"/etc/ssh/sshd_config\" with the following command:\ngrep ClientAliveInterval /etc/ssh/sshd_config\n\nIf the \"ClientAliveInterval\" value is not set to \"300\" or less, this is a finding.\n\nFor UI connections, run the following command to check configured HYCU session timeout:\ncat /opt/grizzly/config.properties | grep api.session.expiration.minutes\n\nIf not configured at \"5\" or less, this is a finding.","fixText":"Configure the operating system to enforce timeout settings.\n\nAdd the following line to \"/home/hycu/.bashrc\" (or modify the line to have the required value):\nTMOUT=300\n\nAdd the following line to \"/etc/ssh/sshd_config\" (or modify the line to have the required value):\nClientAliveInterval 300\n\nEdit the \"/opt/grizzly/config.properties\" file by running the command:\nsudo vi /opt/grizzly/config.properties\n\nAdd the following line or modify the line to have the required value:\napi.session.expiration.minutes=5\n\nSave the file by typing:\n:wq!","ccis":["CCI-001133"]},{"vulnId":"V-268302","ruleId":"SV-268302r1043181_rule","severity":"medium","ruleTitle":"The HYCU virtual appliance must generate unique session identifiers using a FIPS 140-2 approved random number generator.","description":"Sequentially generated session IDs can be easily guessed by an attacker. Employing the concept of randomness in the generation of unique session identifiers helps to protect against brute-force attacks to determine future session identifiers.\n\nUnique session IDs address man-in-the-middle attacks, including session hijacking or insertion of false information into a session. If the attacker is unable to identify or guess the session information related to pending application traffic, they will have more difficulty in hijacking the session or otherwise manipulating valid sessions.\n\nThis requirement is applicable to devices that use a web interface for device management.","checkContent":"When FIPS mode is enabled, HYCU will use FIPS-compliant behavior. Validation of FIPS status can be done using the following command:\n'cat /proc/sys/crypto/fips_enabled' \n\nIf command output does not show \"1\", this is a finding.\n\n'fips-mode-setup --check'\n\nIf command output does not show \"FIPS mode is enabled\", this is a finding.\n\n'update-crypto-policies --show'\n\nIf command output does not show \"FIPS\", this is a finding.","fixText":"Stop the HYCU web server using the following command: \nsudo systemctl stop grizzly.service\n\nEnable FIPS-compliant mode using the following command: \nsudo /opt/grizzly/bin/enable_fips.sh\n\nReboot the HYCU virtual machines using the following command:\nshutdown -r now","ccis":["CCI-001188"]},{"vulnId":"V-268303","ruleId":"SV-268303r1137890_rule","severity":"high","ruleTitle":"The HYCU virtual appliance must be configured to send log data to at least two central log servers for the purpose of forwarding alerts to the administrators and the information system security officer (ISSO).","description":"The aggregation of log data kept on a syslog server can be used to detect attacks and trigger an alert to the appropriate security personnel. The stored log data can used to detect weaknesses in security that enable the network IA team to find and address these weaknesses before breaches can occur. Reviewing these logs, whether before or after a security breach, is important in showing whether someone is an internal employee or an outside threat.","checkContent":"Log in to the HYCU Web UI, navigate to Events >> Notifications >> Webhooks and verify that HYCU is sending required logs to at least at least two central log servers. \n\nIf two webhooks sending required HYCU events to at least two central log servers are not configured, this is a finding.","fixText":"Setting up webhook-based notifications in HYCU allows users to receive alerts and updates about all activities related to the HYCU environment, including job status, errors, and warnings. This ensures users stay informed about the status of the events and can take appropriate actions if needed.\n\nUse HYCU Webhooks to send HYCU events from the HYCU VM to a central logging server (e.g., Splunk, SolarWinds). Configure the webhooks notifications by navigating to Events >> Notifications >> Webhooks and adding a new Webhook. Use the \"Category\" and \"Status\" fields to filter type of events sent out based on organizational requirements.\n\nFor more detailed procedures, consult the following: https://support.hycu.com/hc/en-us/articles/11825154101532-Configuring-Splunk-Webhook-with-HYCU.","ccis":["CCI-001851"]}]}