← Back to Xylok Security Suite 20.x Security Technical Implementation Guide

V-269579

CAT II (Medium)

Xylok Security Suite must disable nonessential capabilities.

Rule ID

SV-269579r1053512_rule

STIG

Xylok Security Suite 20.x Security Technical Implementation Guide

Version

V1R2

CCIs

CCI-000381 CCI-001094 CCI-001095 CCI-001764

Discussion

If Xylok has unnecessary functionality enabled, the server may allow arbitrary code to run within the Xylok container. This would allow the user to potentially launch malicious acts against other hosts from inside the Xylok container. ENABLE_PP_TEST_API setting in the Xylok Security Suite refers to a configuration flag that enables a specific test API related to the policy processing (PP) functionalities of the suite. This setting is used primarily in development or testing environments to enable specific testing functionalities. Satisfies: SRG-APP-000141, SRG-APP-000246, SRG-APP-000247, SRG-APP-000384

Check Content

Verify that Xylok's default ENABLE_PP_TEST_API status is disabled by using the following command:

$ grep ENABLE_PP_TEST_API /etc/xylok.conf

If "ENABLE_PP_TEST_API" exists (case insensitive), this is a finding.

Fix Text

Revert Xylok to its default configuration, which disables the post-processing test API:

1. As root, open /etc/xylok.conf in a text editor.

2. Delete any ENABLE_PP_TEST_API lines from configuration file.

3. Restart Xylok to apply settings:

    # systemctl restart xylok