Navigate

Check: VCRP-67-000006

VMware vSphere 6.7 RhttpProxy STIG: VCRP-67-000006 (in versions v1 r3 through v1 r1)

Title

The rhttpproxy must have logging enabled. (Cat II impact)

Discussion

After a security incident has occurred, investigators will often review log files to determine what happened. The rhttpproxy must create logs upon service startup to capture information relevant to investigations.

Check Content

At the command prompt, execute the following command: # xmllint --xpath '/config/log/outputToFiles' /etc/vmware-rhttpproxy/config.xml Expected result: <outputToFiles>true</outputToFiles> If the output does not match the expected result, this is a finding.

Fix Text

Navigate to and open /etc/vmware-rhttpproxy/config.xml. Locate the <config>/<log> block and configure <outputToFiles> as follows: <outputToFiles>true</outputToFiles> Restart the service for changes to take effect. # vmon-cli --restart rhttpproxy

Additional Identifiers

Rule ID: SV-240721r879562_rule

Vulnerability ID: V-240721

Group Title: SRG-APP-000092-WSR-000055

Expert Comments

Expert comments are only available to logged-in users.

CCIs

CCIs tied to check.

Number	Definition
CCI-001464	Initiates session audits automatically at system start-up.

Controls

Controls tied to check. These are derived from the CCIs shown above.

Number	Title
AU-14(1)	System Start-up