VMware vSphere 6.7 Perfcharts Tomcat STIG Version Comparison
VMware vSphere 6.7 Perfcharts Tomcat Security Technical Implementation Guide
Comparison
There are 3 differences between versions v1 r1 (March 9, 2021) (the "left" version) and v1 r2 (Feb. 8, 2022) (the "right" version).
Check VCPF-67-000005 was changed between these two versions. Green, underlined text was added, red, struck-out text was removed.
The regular view of the left check and right check may be easier to read.
Text Differences
Title
Performance Charts must record user access in a format that enables monitoring of remote access.
Check Content
At the command prompt, execute the following command: # xmllint --format /usr/lib/vmware-perfcharts/tc-instance/conf/server.xml | sed '2 s/xmlns=".*"//g' | xmllint --xpath '/Server/Service/Engine/Host/Valve[@className="org.apache.catalina.valves.AccessLogValve"]'/@pattern - Expected result: pattern="%h %{X-Forwarded-For}i %l %u %t "%r" %s %b "%{User-Agent}i"" "%{User-Agent}i"" If resolveHosts="false" prefix="localhost_access_log" suffix=".txt" /> If the output does not match the expected result, this is a finding.
Discussion
Remote access can be exploited by an attacker to compromise the server. By recording all remote access activities, it will be possible to determine the attacker's location, intent, and degree of success. Tomcat can be configured with an "AccessLogValve", a component that can be inserted into the request processing pipeline to provide robust access logging. The AccessLogValve creates log files in the same format as those created by standard web servers. When AccessLogValve is properly configured, log files will contain all the forensic information necessary in the case of a security incident. Satisfies: SRG-APP-000016-WSR-000005, SRG-APP-000095-WSR-000056, SRG-APP-000096-WSR-000057, SRG-APP-000097-WSR-000058, SRG-APP-000098-WSR-000059, SRG-APP-000098-WSR-000060, SRG-APP-000099-WSR-000061, SRG-APP-000100-WSR-000064, SRG-APP-000374-WSR-000172, SRG-APP-000375-WSR-000171
Fix
Navigate to and open /usr/lib/vmware-perfcharts/tc-instance/conf/server.xml. Add /usr/lib/vmware-perfcharts/tc-instance/conf/server.xml. Inside the following line at the very top of the <Host> node. <Valve className="org.apache.catalina.valves.RemoteIpValve" httpServerPort="80" httpsServerPort="443" protocolHeader="x-forwarded-proto" proxiesHeader="x-forwarded-by" remoteIpHeader="x-forwarded-for" requestAttributesEnabled="true" internalProxies="127\.0\.0\.1"/> Inside the <Host> node, remove add the existing "AccessLogValve" <Valve> node entirely if and replace it with does not exist or update the existing pattern to match the following line: <Valve className="org.apache.catalina.valves.AccessLogValve" directory="${vim.logdir}" pattern="%h %{X-Forwarded-For}i %l %u %t "%r" %s %b "%{User-Agent}i"" resolveHosts="false" prefix="localhost_access_log" suffix=".txt"/>