Check: VCPF-67-000017
VMware vSphere 6.7 Perfcharts Tomcat STIG:
VCPF-67-000017
(in versions v1 r3 through v1 r1)
Title
Performance Charts must fail to a known safe state if system initialization fails, shutdown fails, or aborts fail. (Cat II impact)
Discussion
Determining a safe state for failure and weighing that against a potential denial of service for users depends on what type of application the web server is hosting. For Performance Charts, it is preferable that the service abort startup on any initialization failure rather than continuing in a degraded, and potentially insecure, state.
Check Content
At the command line, execute the following command: # grep EXIT_ON_INIT_FAILURE /usr/lib/vmware-perfcharts/tc-instance/conf/catalina.properties Expected result: org.apache.catalina.startup.EXIT_ON_INIT_FAILURE = true If the output of the command does not match the expected result, this is a finding.
Fix Text
Navigate to and open /usr/lib/vmware-perfcharts/tc-instance/conf/catalina.properties. Add or change the following line: org.apache.catalina.startup.EXIT_ON_INIT_FAILURE=true
Additional Identifiers
Rule ID: SV-239418r879640_rule
Vulnerability ID: V-239418
Group Title: SRG-APP-000225-WSR-000140
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-001190 |
The information system fails to an organization-defined known-state for organization-defined types of failures. |
Controls
Number | Title |
---|---|
SC-24 |
Fail In Known State |