From McAfee VSEL 1.9/2.0 Local Client Security Technical Implementation Guide
Part of SRG-APP-000279
Associated with: CCI-001243
Malware can be hidden within archived files and passed from system to system undetected unless the archive is decompressed and each file scanned. By disabling the archive scanning capability, archives such as .tar and .tgz files will not be decompressed and any infected files in the archives would go undetected. Decompression can slow performance, however; any virus-infected file inside an archive cannot become active until it has been extracted. Recognizing the slow performance potential
From a desktop browser window, connect to the McAfee VirusScan Enterprise for Linux (VSEL) Monitor (WEB interface) of the Linux system being reviewed and logon with the nails user account. In the VSEL WEB Monitor, under "Configure", select "On-Access Settings". Under "Anti-virus Scanning Options", verify the "Decompress archives" check box is selected. If the check box "Decompress archives" is not selected, this is a finding. If the check box for "Decompress archives" is not selected but the On-Demand scan decompress of archives is configured in the regularly scheduled scan, as specified in STIG ID DTAVSEL-101, this is a finding and severity of this can be dropped to a CAT 3. To validate without the Web interface, access the Linux system being reviewed, either at the console or by a SSH connection. At the command line, navigate to /var/opt/NAI/LinuxShield/etc. Enter the command "grep "decompArchive" nailsd.cfg" If the response given includes "nailsd.profile.OAS.decompArchive: false" or includes "nailsd.profile.OAS.decompArchive: true" with a preceding #, this is a finding.
From a desktop browser window, connect to the McAfee VirusScan Enterprise for Linux (VSEL) Monitor (WEB interface) of the Linux system being reviewed and logon with the nails user account. In the VSEL WEB Monitor, under "Configure", select "On-Access Settings". Under "Anti-virus Scanning Options", select the "Decompress archives" check box. Click "Apply".
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer