These instructions describe how to configure Security Analytics hosts that were updated to 10.6 from an earlier version.
Read Before You Run the STIG Script
Please read the following caution statement before you run the STIG hardening script.
Caution: After you run the STIG hardening script, you cannot revert to an unhardened state without performing a build stick on the host. If you want to revert, you must re-image the host and you will lose all of your data. Contact Customer Care to get instructions on how to build stick the host.
Make sure that the STIG rpm is installed with the CENTOS components required fort STIG.
SSH to the host and submit the following command string to make sure that the STIG rpm is installed.
rpm -qa | grep aqueduct-stig
If you receive the following output, the STIG rpm is installed you do not need to complete step 2.
- If the STIG rpm is not installed (that is, no output was displayed in Step 1), use the following command string install 10.6.0.0 STIG rpm.
yum install aqueduct-stig -y
Apply the STIG Hardening Script
Complete the following procedure to apply the STIG hardening to a host updated to 10.6.0 from an earlier version:
- Log on to the host using a normal user account.
Caution: STIG blocks super user access to a host through SSH. You must log on using a normal user account. The STIG script (Aqueduct-STIG.sh) creates the nwadmin account when you run it logged on with the root password. The password for this account must be at least fourteen characters long and include numbers, letters, and at least one special character. You should change the passwords, including root, every 90 days to avoid expiration and lockout of these passwords. If you are completely locked out, you will need the root password to access the host in single user mode.
In addition, the script adds the nwadmin account to the /etc/sudoers file.
- Check for locks on the account:
- Unlock the account, if required:
pam_tally2 --user=<username> --reset
- Run the superuser command. You have three options:
- Run the sudo <command>.
- Run su and provide the root password.
- Run sudo su and provide your user password.
- Go to the /opt/rsa/AqueductSTIG/ directory and run the STIG hardening script:
Caution: After you run the STIG hardening script you must change all the passwords on the system, including the root password, using the superuser credentials. STIG also applies the SHA512 algorithm to all passwords. This means that when you change all the passwords, they must be STIG compliant and conform to the STIG complex password requirements.
The script prompts you to change nwadmin password.
- Enter new password.
- Change all the passwords on the system, including the root password, using the superuser credentials:
- Log on to the host using the root credentials.
- Change all the passwords on the system.
- Restart the host.
(Conditional) Post-STIG Application Task - If You Use Malware Analysis, Update SELinux Parameter
If you use Security Analytics Malware Analysis, you must enable Malware Analysis to communicate with other Security Analytics services. To do this, update the SELINUX parameter in the /etc/selinux/config file to the following value.
For Horton Works
In STIG environment, if you want to run a report on Horton Works system, perform the following:
SSH to the Security Analytics server.
- Navigate to plugins folder using the following command:
Change the permission of the jar file using the following command:
chown rsasoc:rsasoc hive-jdbc-1.2.1-with-full-dependencies.jar
Restart the Reporting Engine.