The Solidcore client Command Line Interface (CLI) must be in lockdown mode.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
high	V-213327	SRG-APP-000383	MCAC-TE-000101	SV-213327r961470_rule	2024-08-27	3

Description
By default, when an endpoint's Solidcore installation is managed by the ePO server, the CLI will automatically be in lockdown mode. This will ensure the endpoint receives all of its Solidcore configuration settings from the ePO server. The CLI can, however, be activated for troubleshooting efforts during which time the ePO settings will not be enforced. Leaving the CLI in an allowed status will prevent the endpoint from receiving changes from the ePO server for the Solidcore client.

Description

By default, when an endpoint's Solidcore installation is managed by the ePO server, the CLI will automatically be in lockdown mode. This will ensure the endpoint receives all of its Solidcore configuration settings from the ePO server. The CLI can, however, be activated for troubleshooting efforts during which time the ePO settings will not be enforced. Leaving the CLI in an allowed status will prevent the endpoint from receiving changes from the ePO server for the Solidcore client.

ℹ️ Check
Determine CLI status. Access the system being reviewed. From an operating system command line, execute the following command: sadmin status <enter> If the status for CLI is "Allowed" or "Recovered", this is a finding.

✔️ Fix
From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Click "Actions". Select "New Client Task Assignment" to open the Client Task Assignment Builder page. Select the "Solidcore 8.x product", "SC: Change Local CLI Access" task type, then click "Create New Task" to open the Client Task Catalog page. Change "CLI status" to "Restrict". Click "Save".

✔️ Fix

From the ePO server console System Tree, select the "Systems" tab. Select "This Group and All Subgroups". Select the asset. Select "Actions". Select "Agent". Click "Actions". Select "New Client Task Assignment" to open the Client Task Assignment Builder page. Select the "Solidcore 8.x product", "SC: Change Local CLI Access" task type, then click "Create New Task" to open the Client Task Catalog page. Change "CLI status" to "Restrict". Click "Save".