PHTN-67-000007 - The Photon operating system must have sshd authentication logging enabled.


Automated monitoring of remote access sessions allows organizations to detect cyberattacks and ensure ongoing compliance with remote access policies by auditing connection activities.

Shipping sshd authentication events to syslog allows organizations to use their log aggregators to correlate forensic activities among multiple systems.


Open /etc/rsyslog.conf with a text editor and locate the following line:

$IncludeConfig /etc/vmware-syslog/syslog.conf

Ensure that the following entry is put beneath the stated line and before the '# vmware services' line.

authpriv.* /var/log/audit/sshinfo.log

If the following line is at the end of the file, it must be removed or commented out:

auth.* /var/log/auth.log

At the command line, execute the following command:

# systemctl restart syslog
# service sshd reload

See Also

Item Details


References: 800-53|AC-17(1), CAT|II, CCI|CCI-000067, Rule-ID|SV-239079r675045_rule, STIG-ID|PHTN-67-000007, Vuln-ID|V-239079

Plugin: Unix

Control ID: 8f3e921348bbb7f582ae6a0cb93621031b17e6e57d2f2c8d5251918f9c79b098