PHTN-67-000007 - The Photon operating system must have sshd authentication logging enabled.
Automated monitoring of remote access sessions allows organizations to detect cyberattacks and ensure ongoing compliance with remote access policies by auditing connection activities. Shipping sshd authentication events to syslog allows organizations to use their log aggregators to correlate forensic activities among multiple systems.
Open /etc/rsyslog.conf with a text editor and locate the following line: $IncludeConfig /etc/vmware-syslog/syslog.conf Ensure that the following entry is put beneath the stated line and before the '# vmware services' line. authpriv.* /var/log/audit/sshinfo.log If the following line is at the end of the file, it must be removed or commented out: auth.* /var/log/auth.log At the command line, execute the following command: # systemctl restart syslog # service sshd reload