Enabling OS STIG hardening for Access Appliance
You can enable OS STIG hardening rules for increased security. These rules are based on the following profile from the Defense Information Systems Agency (DISA):
STIG for Red Hat Enterprise Linux 7 Server - Version V3R3
After the STIG option is enabled, a STIG-compliant password policy is automatically enforced. All the current local user passwords that were created under the default password policy remain valid. Once a password expires, you must follow the STIG-compliant policy rules when you change the password.
Review the following guidelines before enabling STIG:
When you enable STIG, the STIG option is configured for all the nodes in a cluster. The cluster must be configured before you enable the STIG option.
The STIG option does not allow individual rule control.
After the option is enabled, a factory reset is required to disable the associated rules.
If Lightweight Directory Access Protocol (LDAP) is configured, it is recommended that you set it up to use the Transport Layer Security (TLS) protocol before you enable the option.
Before you enable STIG, it is recommended that you complete the following prerequisites. However, not completing the prerequisites does not prevent you from enabling STIG. You can complete these requirements after you enable the STIG option.
Configure two NTP servers to synchronize the time across cluster nodes.
Configure two DNS servers for the cluster.
Configure an SMTP server to enable notifications.
To enable the STIG hardening rules, complete the following steps:
- Log in to the web interface of a configured Access Appliance cluster by opening a supported browser and typing:
http://console-ip:14161
where console-ip is the management console IP address where the web interface is hosted.
- In the navigation pane, click Settings.
- Click Security management.
- On the STIG tab, click Enable STIG.
If the prerequisites are not met, you are prompted to resolve the errors. However you can choose to ignore these errors and proceed by clicking Continue. You can complete the prerequisites later after you enable the STIG option. If the requirements are met, review the displayed guidelines and click Enable STIG.
- To monitor the progress, click View details on the Security page. The ongoing and completed tasks for the operation are also displayed in Recent activity.
After the operation is complete, you can view the STIG status for both the cluster nodes. If the STIG option is enabled for a node, the status is displayed as Enabled. If the STIG option cannot be enabled for a node, the status is displayed as Disabled and if the STIG status cannot be retrieved because the node is stopped, shut down, or unreachable, the status is displayed as Unknown.
For nodes that display Unknown status, you can enable the STIG option again. If STIG is enabled on the cluster and the node is down, it automatically synchronizes its status with the cluster after it is up.
