[ Applies to ] StorageGuard / Dell PowerStore / Unified Storage
This article lists the recommended baseline checks for Dell PowerStore. Core6 updates the list periodically as new StorageGuard checks become available.
In this article
Overview
Dell PowerStore is an NVMe-based unified storage platform that delivers block storage and native file services from a single appliance, with data reduction and automation.
Why hardening Dell PowerStore matters
PowerStore often consolidates virtual machines, databases and file shares on one platform, so a single security incident can affect many applications at once. Encryption, role-based access, immutable snapshots and auditing protect that combined workload.
Recommended baseline checks
The baseline below contains 86 checks, listed alphabetically.
| ID | Configuration check | Component |
|---|---|---|
| SG-C0126T241V01 | Anonymous user access | PowerStore Manager |
| SG-F7385T241V01 | Antivirus status | PowerStore Manager |
| SG-C0163T241V01 | Approved AD domain | PowerStore Manager |
| SG-F6356T241V01 | Approved admin group | PowerStore Manager |
| SG-F9788T241V01 | Approved DNS servers - File | PowerStore Manager |
| SG-F4223T241V01 | Approved Kerberos realm | PowerStore Manager |
| SG-F5025T241V01 | Approved KMS server | PowerStore Manager |
| SG-C0435T241V01 | Approved LDAP servers | PowerStore Manager |
| SG-F7876T241V01 | Approved NTP servers | PowerStore Manager |
| SG-F6065T241V01 | Approved SNMP trap hosts | PowerStore Manager |
| SG-F4989T241V01 | Approved Syslog servers | PowerStore Manager |
| SG-C0029T241V01 | Centralized log server | PowerStore Manager |
| SG-F6697T241V01 | Centralized log server redundancy | PowerStore Manager |
| SG-F5104T241V01 | Certificate Issuer | PowerStore Manager |
| SG-F4468T241V01 | Certificate signature algorithm strength | PowerStore Manager |
| SG-F3971T241V01 | Certificate type | PowerStore Manager |
| SG-F3059T241V01 | CHAP authentication mode | PowerStore Manager |
| SG-F4305T241V01 | CIFS SMB configured ACL | PowerStore Manager |
| SG-F8484T241V01 | CIFS SMB encryption (policy) | PowerStore Manager |
| SG-F1224T241V01 | CIFS SMB new file/folder permissions ("umask") | PowerStore Manager |
| SG-C0065T241V01 | Data at-rest encryption | PowerStore Manager |
| SG-F8004T241V01 | Data copies status | PowerStore Manager |
| SG-F7970T241V01 | Default passwords | PowerStore Manager |
| SG-F1298T241V01 | DNS server configuration - File | PowerStore Manager |
| SG-F4971T241V01 | DNS server redundancy - File | PowerStore Manager |
| SG-F2437T241V01 | DNS service status | PowerStore Manager |
| SG-F7850T241V01 | Email notification | PowerStore Manager |
| SG-C0602T242V01 | End of extended support | Appliance |
| SG-C0600T242V01 | End of support | Appliance |
| SG-F4411T241V01 | Eradication delay (secure data erasure) | PowerStore Manager |
| SG-F2705T241V01 | Event types enabled for audit logging | PowerStore Manager |
| SG-C0175T241V02 | Event types enabled for audit logging - File event | PowerStore Manager |
| SG-C0175T241V03 | Event types enabled for audit logging - SMB file access | PowerStore Manager |
| SG-C0175T241V04 | Event types enabled for audit logging - SMB file write | PowerStore Manager |
| SG-F5012T241V01 | Expired SSL certificate | PowerStore Manager |
| SG-C0569T241V01 | File system access policy | PowerStore Manager |
| SG-F6213T241V01 | File system directory rename policy | PowerStore Manager |
| SG-C0177T241V01 | FIPS mode status | PowerStore Manager |
| SG-C0602T242V02 | Future end of extended support | Appliance |
| SG-C0600T242V02 | Future end of support | Appliance |
| SG-C0381T241V01 | HTTP service status | PowerStore Manager |
| SG-C0209T241V01 | Idle session timeout | PowerStore Manager |
| SG-F5259T241V01 | Immutable snapshots (rule) | PowerStore Manager |
| SG-F7463T241V01 | Kerberos status | PowerStore Manager |
| SG-C0047T241V01 | KMIP status | PowerStore Manager |
| SG-C0049T241V01 | KMS server configuration | PowerStore Manager |
| SG-F1512T241V01 | KMS server redundancy | PowerStore Manager |
| SG-C0039T241V01 | LDAP server configuration | PowerStore Manager |
| SG-C0039T241V02 | LDAP server configuration - NAS Server | PowerStore Manager |
| SG-C0025T241V01 | LDAP server redundancy | PowerStore Manager |
| SG-F7730T241V01 | LDAP server redundancy - NAS server | PowerStore Manager |
| SG-F5784T241V01 | Lockout enforcement for admin | PowerStore Manager |
| SG-C0427T241V01 | Login banner message | PowerStore Manager |
| SG-C0426T241V01 | Login banner status | PowerStore Manager |
| SG-C0239T241V01 | Multi-factor authentication | PowerStore Manager |
| SG-F1457T241V01 | NFS export default access | PowerStore Manager |
| SG-F4225T241V01 | NFS export security protocol | PowerStore Manager |
| SG-F5741T241V01 | Non-default local admin | PowerStore Manager |
| SG-F4633T241V01 | Non-default local users | PowerStore Manager |
| SG-F6152T241V01 | NTP server redundancy | PowerStore Manager |
| SG-F2267T241V01 | NTP service status | PowerStore Manager |
| SG-F7281T241V01 | Ransomware protection policy | PowerStore Manager |
| SG-F7124T241V01 | Required DNS servers - File | PowerStore Manager |
| SG-C0565T242V01 | SED encryption status | Appliance |
| SG-F7276T241V01 | Self-signed certificate | PowerStore Manager |
| SG-F3428T241V01 | SMB share allow read write ACL | PowerStore Manager |
| SG-F1911T241V01 | SMB share deny ACL | PowerStore Manager |
| SG-C0395T241V01 | SMTP server configuration | PowerStore Manager |
| SG-F3438T241V01 | SNMP community default string | PowerStore Manager |
| SG-C0403T241V01 | SNMP minimum storage alerts level | PowerStore Manager |
| SG-F7398T241V01 | SNMP service configuration | PowerStore Manager |
| SG-F3334T241V01 | SNMP service status | PowerStore Manager |
| SG-C0123T241V01 | SNMP versions enabled | PowerStore Manager |
| SG-C0422T241V01 | SNMPv3 privacy encryption algorithm | PowerStore Manager |
| SG-C0419T241V01 | SNMPv3 user authentication protocol | PowerStore Manager |
| SG-F3259T241V01 | SSH status - service user | PowerStore Manager |
| SG-F5743T241V01 | SSL key bitcount | PowerStore Manager |
| SG-C0180T241V01 | STIG mode | PowerStore Manager |
| SG-C0306T241V01 | Syslog communication protocol | PowerStore Manager |
| SG-F5124T241V01 | Target PowerStore version | PowerStore Manager |
| SG-C0005T241V01 | TLS audit logging | PowerStore Manager |
| SG-C0390T241V01 | TLS level | PowerStore Manager |
| SG-F1121T241V01 | Trusted certificate-authority (CA) | PowerStore Manager |
| SG-C0213T241V01 | Use of secure LDAP | PowerStore Manager |
| SG-C0213T241V02 | Use of secure LDAP - NAS Server | PowerStore Manager |
| SG-C0567T241V01 | Vasa retain certificate | PowerStore Manager |
Related components
A complete baseline also covers the components that manage, connect to or protect Dell PowerStore. Review the configuration of:
- PowerStore Manager and REST API clients
- CloudIQ and SupportAssist
- Replication peers
Run checks with StorageGuard
Want automated validation? StorageGuard continuously scans Dell PowerStore against a baseline and reports misconfigurations, with remediation guidance. Contact us to see it in your environment, or learn more about StorageGuard.
[ Still need help? ]
Our support team is here to help. Submit a request.
Comments
0 comments
Please sign in to leave a comment.