Check: VCRP-67-000005
VMware vSphere 6.7 RhttpProxy STIG:
VCRP-67-000005
(in versions v1 r3 through v1 r1)
Title
The rhttpproxy must produce log records containing sufficient information to establish the source of events. (Cat II impact)
Discussion
After a security incident has occurred, investigators will often review log files to determine what happened, and determining the source of an event is crucial for forensics. The rhttpproxy must be configured for verbose logging to capture client IP addresses and the associated actions.
Check Content
At the command prompt, execute the following command: # xmllint --xpath '/config/log/level' /etc/vmware-rhttpproxy/config.xml Expected result: <level>verbose</level> If the output does not match the expected result, this is a finding.
Fix Text
Navigate to and open /etc/vmware-rhttpproxy/config.xml. Locate the <config>/<log> block and configure <level> as follows: <level>verbose</level> Restart the service for changes to take effect. # vmon-cli --restart rhttpproxy
Additional Identifiers
Rule ID: SV-240720r879521_rule
Vulnerability ID: V-240720
Group Title: SRG-APP-000016-WSR-000005
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000067 |
The information system monitors remote access methods. |
Controls
Number | Title |
---|---|
AC-17 (1) |
Automated Monitoring / Control |