What changed in Xylok Security Suite 20.x STIG V1R2V1R2 changes

Check text

Check the Xylok lib file permissions with the following command: $ ls -l /var/lib/xylok/data If the "db" filedirectory has permissions greater than "0700", this is a finding. $ ls -l /var/lib/xylok If any other file or directory has permissions greater than "0755", this is a finding.

V-269569 in V1R2

Check text

Verify session is configured to lock after 15 minutes of inactivity. Execute the following: $ grep SESSION_LENGTH /etc/xylok.conf SESSION_LENGTH=900 If "SESSION_LENGTH" is set to more than15than 15 minutes or is missing, this is a finding. Note: The setting is in seconds. 900 secseconds = 15 min.minutes

V-269571 in V1R2

Check text

Verify SIEM.that Onjournald thesends hostlogs server,to ensurersyslog: # grep ForwardToSyslog /etc/rsyslog.dsystemd/101-xylokjournald.conf ForwardToSyslog=yes If existsForwardToSyslog andis containscommented theout followingor contents:not $ModLoadset imfile $InputFileNameto /var/log/xylok/api/current $InputFileTag"yes," xylok-api: $InputFileStateFilethis /tmp/xylok-api-log-state $InputFileSeverityis info $InputFileFacilitya local3finding. $InputRunFileMonitor $InputFileNameVerify /var/log/xylok/db/current $InputFileTagthat xylok-db: $InputFileStateFilersyslog /tmp/xylok-db-log-state $InputFileSeverityis info $InputFileFacilityset local3 $InputRunFileMonitor to $InputFileNamereceive /var/log/xylok/mx/current $InputFileTagjournald xylok-mxlogs: $InputFileStateFile /tmp/xylok-mx-log-state $InputFileSeverity # info $InputFileFacilitygrep local3 $InputRunFileMonitor '1(imuxsock1|imjournal1)' $InputFileName /varetc/logrsyslog.conf /xyloketc/primaryrsyslog.d/current* $InputFileTag module(load="imuxsock") xylok-primary: $InputFileStateFile# /tmp/xylok-primary-log-state $InputFileSeverityprovides info $InputFileFacilitysupport local3 $InputRunFileMonitor $InputFileNamefor /var/log/xylok/web/current $InputFileTaglocal xylok-web: $InputFileStateFilesystem /tmp/xylok-web-log-statelogging $InputFileSeverity module(load="imjournal") info $InputFileFacility# local3 $InputRunFileMonitor provides $InputFileNameaccess /var/log/xylok/worker/current $InputFileTagto xylok-worker: $InputFileStateFilethe /tmp/xylok-worker-log-state $InputFileSeveritysystemd infojournal $InputFileFacility local3 $InputRunFileMonitor If theeither filemodule contentsis do not monitorpresent allor logs in /var/log/xylok/disabled, this is a finding. If # thegrep '[[:space:]]@.*' /etc/rsyslog.conf destination/etc/rsyslog.d/* *.* @@yoursiem:1234 If rsyslog is not configured to sendforward logs to a validcentral syslogSIEM server, this is a finding. Note: The rsyslog destination host may appear in a different file, often following a format similar to "*.* @siem.example.com:514.

Fix text

CreateEdit /etc/rsyslog.dsystemd/100-xylokjournald.conf with these contents, ensuring the final line points to ainclude validat syslogleast server.these lines: $ModLoad imfile[Journal] $InputFileName /var/log/xylok/api/currentForwardToSyslog=yes $InputFileTag xylok-api: $InputFileStateFileEdit /tmpetc/xylok-api-log-state $InputFileSeverityrsyslog.conf info $InputFileFacilityto local3 $InputRunFileMonitorinclude $InputFileNamethese /var/log/xylok/db/current $InputFileTag xylok-dblines: $InputFileStateFile /tmp/xylok-db-log-state $InputFileSeveritymodule(load="imuxsock") info $InputFileFacility# local3 $InputRunFileMonitor provides $InputFileNamesupport /var/log/xylok/mx/current $InputFileTagfor xylok-mx: $InputFileStateFilelocal /tmp/xylok-mx-log-state $InputFileSeveritysystem infologging $InputFileFacilitymodule(load="imjournal") local3 $InputRunFileMonitor # $InputFileNameprovides /var/log/xylok/primary/current $InputFileTagaccess xylok-primary: $InputFileStateFileto /tmp/xylok-primary-log-state $InputFileSeveritythe infosystemd journal $InputFileFacility*.* local3@@yoursiem:1234 $InputRunFileMonitor $InputFileNameEnsure /var/log/xylok/web/current $InputFileTag xylok-webyoursiem: $InputFileStateFile1234 /tmp/xylok-web-log-state $InputFileSeveritypoints info $InputFileFacilityto local3 $InputRunFileMonitor the $InputFileNamecorrect /var/log/xylok/worker/current $InputFileTaghost xylok-worker: $InputFileStateFileand /tmp/xylok-worker-log-state $InputFileSeverityport info $InputFileFacilityfor local3 $InputRunFileMonitoryour network. Restart rsyslogjournald toand apply changesrsyslogd: sudo # systemctl restartrestar rsyslog systemd-journald

V-269586 in V1R2