Sys Maintenance: Configure STIG Hardening for 10.6 Updated from Earlier Version

These instructions describe how to configure Security Analytics hosts that were updated to 10.6 from an earlier version. 

Read Before You Run the STIG Script

Please read the following caution statement before you run the STIG hardening script.

Caution: After you run the STIG hardening script, you cannot revert to an unhardened state without performing a build stick on the host. If you want to revert, you must re-image the host and you will lose all of your data. Contact Customer Care to get instructions on how to build stick the host.

Prerequisite

Make sure that the STIG rpm is installed with the CENTOS components required fort STIG.

1. SSH to the host and submit the following command string to make sure that the STIG rpm is installed.
   rpm -qa | grep aqueduct-stig
   If you receive the following output, the STIG rpm is installed you do not need to complete step 2.
   aqueduct-stig-10.6.0.0.xxxx-x.el6.noarch

2. If the STIG rpm is not installed (that is, no output was displayed in Step 1), use the following command string install 10.6.0.0 STIG rpm.
   yum install aqueduct-stig -y

Apply the STIG Hardening Script

Complete the following procedure to apply the STIG hardening to a host updated to 10.6.0 from an earlier version:

1. Log on to the host using a normal user account. 

Caution: STIG blocks super user access to a host through SSH. You must log on using a normal user account. The STIG script (Aqueduct-STIG.sh) creates the nwadmin account when you run it logged on with the root password. The password for this account must be at least fourteen characters long and include numbers, letters, and at least one special character. You should change the passwords, including root, every 90 days to avoid expiration and lockout of these passwords. If you are completely locked out, you will need the root password to access the host in single user mode.

In addition, the script adds the nwadmin account to the /etc/sudoers file.

1. Check for locks on the account:
   pam_tally2 --user=<username>
2. Unlock the account, if required:
   pam_tally2 --user=<username> --reset

2. Run the superuser command. You have three options:
   • Run the sudo <command>.
   • Run su and provide the root password.
   • Run sudo su and provide your user password.
   You can add more user accounts to the /etc/sudoers file as needed.
3. Go to the /opt/rsa/AqueductSTIG/ directory and run the STIG hardening script:
   ./Aqueduct-STIG.sh

Caution: After you run the STIG hardening script you must change all the passwords on the system, including the root password, using the superuser credentials. STIG also applies the SHA512 algorithm to all passwords. This means that when you change all the passwords, they must be STIG compliant and conform to the STIG complex password requirements.

The script prompts you to change nwadmin password. 

4. Enter new password.
5. Change all the passwords on the system, including the root password, using the superuser credentials:
   1. Log on to the host using the root credentials.
   2. Change all the passwords on the system.
6. Restart the host.

(Conditional) Post-STIG Application Task - If You Use Malware Analysis, Update SELinux Parameter

If you use Security Analytics Malware Analysis, you must enable Malware Analysis to communicate with other Security Analytics services.  To do this, update the SELINUX parameter in the /etc/selinux/config file to the following value.

SELINUX=disabled