These instructions describe how to configure Security Analytics hosts that were updated to 10.6 from an earlier version.
Read Before You Run the STIG Script
Please read the following caution statement before you run the STIG hardening script.
Make sure that the STIG rpm is installed with the CENTOS components required fort STIG.
SSH to the host and submit the following command string to make sure that the STIG rpm is installed.
rpm -qa | grep aqueduct-stig
If you receive the following output, the STIG rpm is installed you do not need to complete step 2.
- If the STIG rpm is not installed (that is, no output was displayed in Step 1), use the following command string install 10.6.0.0 STIG rpm.
yum install aqueduct-stig -y
Apply the STIG Hardening Script
Complete the following procedure to apply the STIG hardening to a host updated to 10.6.0 from an earlier version:
- Log on to the host using a normal user account.
- Check for locks on the account:
- Unlock the account, if required:
pam_tally2 --user=<username> --reset
- Run the superuser command. You have three options:
- Run the sudo <command>.
- Run su and provide the root password.
- Run sudo su and provide your user password.
- Go to the /opt/rsa/AqueductSTIG/ directory and run the STIG hardening script:
The script prompts you to change nwadmin password.
- Enter new password.
- Change all the passwords on the system, including the root password, using the superuser credentials:
- Log on to the host using the root credentials.
- Change all the passwords on the system.
- Restart the host.
(Conditional) Post-STIG Application Task - If You Use Malware Analysis, Update SELinux Parameter
If you use Security Analytics Malware Analysis, you must enable Malware Analysis to communicate with other Security Analytics services. To do this, update the SELINUX parameter in the /etc/selinux/config file to the following value.