VMware vSphere 6.7 VAMI-lighttpd STIG
VMware vSphere 6.7 VAMI-lighttpd Security Technical Implementation Guide. Version v1 r2, released Feb. 8, 2022.
VCLD-67-000001: VAMI must limit the number of simultaneous requests.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # grep "server.max-connections = 1024" /opt/vmware/etc/lighttpd/lighttpd.conf Expected result: server.max-connections = 1024 If the output does not match the expected result, this is a finding.
Discussion
Denial of service (DoS) is one threat against web servers. Many DoS attacks attempt to consume web server resources in such a way that no more resources are available to satisfy legitimate requests. Mitigation against these threats is to take steps to limit the number of resources that can be consumed in certain ways. VAMI provides the "maxConnections" attribute of the <Connector Elements> to limit the number of concurrent TCP connections. This comes preconfigured with a tested, supported value that must be verified and maintained.
Fix
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Add or reconfigure the following value: server.max-connections = 1024
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None
VCLD-67-000032: VAMI configuration files must be protected from unauthorized access.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # stat -c "%n permissions are %a and ownership is %U:%G" /opt/vmware/etc/lighttpd/lighttpd.conf /etc/applmgmt/appliance/lighttpd.conf Expected result: /opt/vmware/etc/lighttpd/lighttpd.conf permissions are 644 and ownership is root:root /etc/applmgmt/appliance/lighttpd.conf permissions are 644 and ownership is root:root If the output does not match the expected result, this is a finding.
Discussion
Accounts on the VAMI server are to be kept to a minimum. Only administrators, web managers, developers, auditors, and web authors require accounts on the machine hosting the Lighttpd server. The resources to which these accounts have access must also be closely monitored and controlled. Only the system administrator needs access to all of the system's capabilities, while the web administrator and associated staff require access and control of the web content and the Lighttpd server configuration files.
Fix
At the command prompt, enter the following command: # chmod 644 <file> # chown root:root <file> Note: Replace <file> with every file returned from the command in the check.
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None
VCLD-67-000015: VAMI server binaries and libraries must be verified for their integrity.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # rpm -qa|grep lighttpd|xargs rpm -V|grep -vE "lighttpd.conf|vami-lighttp.*\.service" If the command returns any output, this is a finding.
Discussion
Being able to verify that a patch, upgrade, certificate, etc., being added to the web server is unchanged from the producer of the file is essential for file validation and non-repudiation of the information. VMware delivers product updates and patches regularly. When VAMI is updated, the signed packages will also be updated. These packages can be used to verify that VAMI has not been inappropriately modified since it was installed.
Fix
If the VAMI binaries have been modified from the default state when deployed as part of the VCSA, the system must be wiped and redeployed or restored from backup. VMware does not recommend or support recovering from such a state by reinstalling RPMs or similar efforts.
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None
VCLD-67-000014: Rsyslog must be configured to monitor VAMI logs.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # grep -v "^#" /etc/vmware-syslog/stig-services-vami.conf Expected result: input(type="imfile" File="/opt/vmware/var/log/lighttpd/access.log" Tag="vami-access" Severity="info" Facility="local0") If the file does not exist, this is a finding. If the output of the command does not match the expected result above, this is a finding.
Discussion
For performance reasons, rsyslog file monitoring is preferred over configuring VAMI to send events to a syslog facility. Without ensuring that logs are created, that rsyslog configs are created, and that those configs are loaded, the log file monitoring and shipping will not be effective. Satisfies: SRG-APP-000125-WSR-000071, SRG-APP-000358-WSR-000063, SRG-APP-000358-WSR-000163
Fix
Navigate to and open /etc/vmware-syslog/stig-services-vami.conf. Create the file if it does not exist. Set the contents of the file as follows: input(type="imfile" File="/opt/vmware/var/log/lighttpd/access.log" Tag="vami-access" Severity="info" Facility="local0")
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None
VCLD-67-000022: VAMI must prevent hosted applications from exhausting system resources.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|grep "server.max-keep-alive-idle" Expected result: server.max-keep-alive-idle = 30 If the output does not match the expected result, this is a finding.
Discussion
Most of the attention to denial-of-service (DoS) attacks focuses on ensuring that systems and applications are not victims of these attacks. However, these systems and applications must also be secured against use to launch such an attack against others. A variety of technologies exist to limit or, in some cases, eliminate the effects of DoS attacks. Limiting system resources that are allocated to any user to a bare minimum may also reduce the ability of users to launch some DoS attacks. One DoS mitigation is to prevent VAMI from keeping idle connections open for too long.
Fix
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf file. Add or reconfigure the following value: server.max-keep-alive-idle = 30
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None
VCLD-67-000029: VAMI must disable directory browsing.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|grep "dir-listing.activate" Expected result: dir-listing.activate = "disable" If the output does not match the expected result, this is a finding.
Discussion
The goal is to completely control the web user's experience in navigating any portion of the web document root directories. Ensuring all web content directories have at least the equivalent of an "index.html" file is a significant factor to accomplish this end. Enumeration techniques, such as URL parameter manipulation, rely on being able to obtain information about the web server's directory structure by locating directories without default pages. In this scenario, the web server will display to the user a listing of the files in the directory being accessed. By having a default hosted application web page, the anonymous web user will not obtain directory browsing information or an error message that reveals the server type and version.
Fix
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Add or reconfigure the following value: dir-listing.activate = "disable"
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None
VCLD-67-000031: VAMI must have debug logging disabled.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|grep "debug.log-request-handling" Expected result: debug.log-request-handling = "disable" If the output does not match the expected result, this is a finding.
Discussion
Information needed by an attacker to begin looking for possible vulnerabilities in a web server includes any information about the web server and plug-ins or modules being used. When debugging or trace information is enabled in a production web server, information about the web server, such as web server type, version, patches installed, plug-ins and modules installed, type of code being used by the hosted application, and any backends being used for data storage, may be displayed. Since this information may be placed in logs and general messages during normal operation of the web server, an attacker does not need to cause an error condition to gain this information.
Fix
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Add or reconfigure the following value: debug.log-request-handling = "disable"
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None
VCLD-67-000027: VAMI must protect against or limit the effects of HTTP types of denial-of-service (DoS) attacks.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|grep "server.max-fds" Expected result: server.max-fds = 2048 If the output does not match the expected result, this is a finding.
Discussion
In UNIX and related computer operating systems, a file descriptor is an indicator used to access a file or other input/output resource, such as a pipe or network connection. File descriptors index into a per-process file descriptor table maintained by the kernel, which in turn indexes into a system-wide table of files opened by all processes, called the file table. As a single-threaded server, Lighttpd must be limited in the number of file descriptors that can be allocated. This will prevent Lighttpd from being used in a form of DoS attack against the operating system.
Fix
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Add or reconfigure the following value: server.max-fds = 2048
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None
VCLD-67-000023: VAMI must not have any symbolic links in the web content directory tree.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # find /opt/vmware/share/htdocs -type l If any files are listed, this is a finding.
Discussion
A web server is designed to deliver content and execute scripts or applications on the request of a client or user. Containing user requests to files in the directory tree of the hosted web application and limiting the execution of scripts and applications guarantees that the user is not accessing information protected outside the application's realm. By checking that no symbolic links exist in the document root, the web server is protected from users jumping outside the hosted application directory tree and gaining access to the other directories, including the system root.
Fix
At the command prompt, enter the following command: # unlink <file_name> Note: Replace <file_name> for the name of any files that were returned. Repeat the command for each file that was listed.
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None
VCLD-67-000019: VAMI must remove all mappings to unused scripts.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|awk '/cgi\.assign/,/\)/' Expected result: cgi.assign = ( ".pl" => "/usr/bin/perl", ".cgi" => "/usr/bin/perl", ".rb" => "/usr/bin/ruby", ".erb" => "/usr/bin/eruby", ".py" => "/usr/bin/python", # 5 ) If the output does not match the expected result, this is a finding.
Discussion
Scripts allow server-side processing on behalf of the hosted application user or as processes needed in the implementation of hosted applications. Removing scripts not needed for application operation or deemed vulnerable helps to secure the web server. To ensure scripts are not added to the web server and run maliciously, script mappings that are not needed or used by the web server for hosted application operation must be removed.
Fix
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Configure the "cgi.assign" section to the following: cgi.assign = ( ".pl" => "/usr/bin/perl", ".cgi" => "/usr/bin/perl", ".rb" => "/usr/bin/ruby", ".erb" => "/usr/bin/eruby", ".py" => "/usr/bin/python", # 5 )
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None
VCLD-67-000028: VAMI must set the encoding for all text mime types to UTF-8.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|awk '/mimetype\.assign/,/\)/'|grep "text/"|grep -v "charset=utf-8" If the command returns any value, this is a finding.
Discussion
Invalid user input occurs when a user inserts data or characters into a hosted application's data entry field and the hosted application is unprepared to process that data. This results in unanticipated application behavior, potentially leading to an application compromise. Invalid user input is one of the primary methods employed when attempting to compromise an application. An attacker can also enter Unicode into hosted applications in an effort to break out of the document home or root home directory or to bypass security checks.
Fix
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Navigate to the "mimetype.assign" block. Replace all the mappings whose assigned type is "text/*" with mappings for UTF-8 encoding, as follows: ".css" => "text/css; charset=utf-8", ".html" => "text/html; charset=utf-8", ".htm" => "text/html; charset=utf-8", ".js" => "text/javascript; charset=utf-8", ".asc" => "text/plain; charset=utf-8", ".c" => "text/plain; charset=utf-8", ".cpp" => "text/plain; charset=utf-8", ".log" => "text/plain; charset=utf-8", ".conf" => "text/plain; charset=utf-8", ".text" => "text/plain; charset=utf-8", ".txt" => "text/plain; charset=utf-8", ".spec" => "text/plain; charset=utf-8", ".dtd" => "text/xml; charset=utf-8", ".xml" => "text/xml; charset=utf-8",
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None
VCLD-67-000017: VAMI must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|awk '/mimetype\.assign/,/\)/'|grep -E "\.sh|\.csh" If the command returns any value, this is a finding.
Discussion
Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or the user could use the function in an unintentional manner. A MIME tells the web server what type of program various file types and extensions are and what external utilities or programs are needed to execute the file type. There is no reason for VAMI to have MIME types configured for shell scripts.
Fix
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Remove any lines that reference ".sh" or ".csh" from the "mimetype.assign" section.
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None
VCLD-67-000034: VAMI must implement TLS1.2 exclusively.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|grep "ssl.use" Expected result: ssl.use-tlsv12 = "enable" ssl.use-sslv2 = "disable" ssl.use-sslv3 = "disable" ssl.use-tlsv10 = "disable" ssl.use-tlsv11 = "disable" If the output does not match the expected result, this is a finding.
Discussion
Transport Layer Security (TLS) is a required transmission protocol for a web server hosting controlled information. The use of TLS provides confidentiality of data in transit between the web server and client. FIPS 140-2 approved TLS versions must be enabled, and non-FIPS-approved SSL versions must be disabled. VAMI comes configured to use only TLS 1.2. This configuration must be verified and maintained.
Fix
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Replace any and all "ssl.use-*" lines with following: ssl.use-tlsv12 = "enable" ssl.use-sslv2 = "disable" ssl.use-sslv3 = "disable" ssl.use-tlsv10 = "disable" ssl.use-tlsv11 = "disable"
Rating Info
DISA Cat I. NIST impact 4.
Expert Comment
None
VCLD-67-000016: VAMI must only load allowed server modules.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|awk '/server\.modules/,/\)/' Expected result: server.modules = ( "mod_access", "mod_accesslog", "mod_proxy", "mod_cgi", "mod_rewrite", "mod_magnet", "mod_setenv", # 7 ) If the output does not match the expected result, this is a finding.
Discussion
A web server can provide many features, services, and processes. Some of these may be deemed unnecessary or too unsecure to run on a production DoD system. VAMI can be configured to load any number of external modules, but only a specific few are provided and supported by VMware. Additional, unexpected modules must be removed.
Fix
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Configure the "server.modules" section to the following: server.modules = ( "mod_access", "mod_accesslog", "mod_proxy", "mod_cgi", "mod_rewrite", ) server.modules += ( "mod_magnet" )
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None
VCLD-67-000003: VAMI must use cryptography to protect the integrity of remote sessions.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|grep "ssl.engine" Expected result: ssl.engine = "enable" If the output does not match the expected result, this is a finding.
Discussion
Data exchanged between the user and the web server can range from static display data to credentials used to log in to the hosted application. Even when data appears to be static, the non-displayed logic in a web page may expose business logic or trusted system relationships. The integrity of all the data being exchanged between the user and web server must always be trusted. To protect the integrity and trust, encryption methods should be used to protect the complete communication session. To protect the integrity and confidentiality of the remote sessions, VAMI uses SSL/TLS. Satisfies: SRG-APP-000015-WSR-000014, SRG-APP-000172-WSR-000104, SRG-APP-000315-WSR-000003, SRG-APP-000141-WSR-000076, SRG-APP-000439-WSR-000151, SRG-APP-000439-WSR-000152, SRG-APP-000442-WSR-000182
Fix
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Add or reconfigure the following value: ssl.engine = "enable"
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None
VCLD-67-000020: VAMI must have resource mappings set to disable the serving of certain file types.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|grep "url.access-deny" Expected result: url.access-deny = ("~", ".inc") If the output does not match the expected result, this is a finding.
Discussion
Resource mapping is the process of tying a particular file type to a process in the web server that can serve that type of file to a requesting client and identify which file types are not to be delivered to a client. By not specifying which files can and cannot be served to a user, VAMI could potentially deliver sensitive files.
Fix
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Add or reconfigure the following value: url.access-deny = ( "~", ".inc" )
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None
VCLD-67-000002: VAMI must be configured with FIPS 140-2 compliant ciphers for HTTPS connections.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|grep "ssl.cipher-list" Expected result: ssl.cipher-list = "!aNULL:kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH+AES:RSA+AES" If the output does not match the expected result, this is a finding.
Discussion
Encryption of data in flight is an essential element of protecting information confidentiality. If a web server uses weak or outdated encryption algorithms, the server's communications can potentially be compromised. The U.S. Federal Information Processing Standards (FIPS) publication 140-2, Security Requirements for Cryptographic Modules (FIPS 140-2), identifies 11 areas for a cryptographic module used inside a security system that protects information. FIPS 140-2 approved ciphers provide the maximum level of encryption possible for a private web server. VAMI is compiled to use VMware's FIPS-validated OpenSSL module and cannot be configured otherwise. Ciphers may still be specified in order of preference, but no non-FIPS-approved ciphers will be implemented. Satisfies: SRG-APP-000014-WSR-000006, SRG-APP-000179-WSR-000111, SRG-APP-000416-WSR-000118, SRG-APP-000439-WSR-000188
Fix
Navigate to and open /etc/applmgmt/appliance/lighttpd.conf. Add or reconfigure the following value: ssl.cipher-list = "!aNULL:kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH+AES:RSA+AES"
Rating Info
DISA Cat I. NIST impact 4.
Expert Comment
None
VCLD-67-000004: VAMI must be configured to monitor remote access.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|awk '/server\.modules/,/\)/'|grep mod_accesslog Expected result: "mod_accesslog", If the output does not match the expected result, this is a finding.
Discussion
Remote access can be exploited by an attacker to compromise the server. By recording all remote access activities, it will be possible to determine the attacker's location, intent, and degree of success. VAMI uses the "mod_accesslog" module to log information relating to remote requests. These logs can then be piped to external monitoring systems. Satisfies: SRG-APP-000016-WSR-000005
Fix
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Add the following value in the "server.modules" section: mod_accesslog The result should be similar to the following: server.modules = ( "mod_access", "mod_accesslog", "mod_proxy", "mod_cgi", "mod_rewrite", "mod_magnet", "mod_setenv", # 7 )
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None
VCLD-67-000026: VAMI must restrict access to the web root.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # find /opt/vmware/share/htdocs/ -xdev -type d -a '(' -not -perm 0755 -o -not -user root -o -not -group root ')' -exec ls -ld {} \; If any files are returned, this is a finding.
Discussion
As a rule, accounts on a web server are to be kept to a minimum, and those accounts are then restricted as to what they are allowed to access. The web root of the VAMI Lighttpd installation contains the content that is served up to the end user. This content must have the minimum necessary permissions and proper ownership to help protect against unprivileged modification of the content.
Fix
At the command prompt, execute the following commands: # chmod 0755 <directory> # chown root:root <directory> Note: Substitute <directory> with each directory returned from the check.
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None
VCLD-67-000018: VAMI must explicitly disable Multipurpose Internet Mail Extensions (MIME) mappings based on "Content-Type".
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|grep "mimetype.use-xattr" Expected result: mimetype.use-xattr = "disable" If the output does not match the expected result, this is a finding.
Discussion
Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or the user could use the function in an unintentional manner. A MIME tells the web server what type of program various file types and extensions are and what external utilities or programs are needed to execute the file type. A limited number of MIME types must be configured manually and automatic mapping must be disabled.
Fix
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Add or reconfigure the following value: mimetype.use-xattr = "disable"
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None
VCLD-67-000005: VAMI must generate log records for system startup and shutdown.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|grep "server.errorlog" Expected result: server.errorlog = "/opt/vmware/var/log/lighttpd/error.log" If the output does not match the expected result, this is a finding.
Discussion
Logging must be started as soon as possible when a service starts and when a service is stopped. Many forms of suspicious actions can be detected by analyzing logs for unexpected service starts and stops. Also, by starting to log immediately after a service starts, it becomes more difficult for suspicious activity to go unlogged.
Fix
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Add or reconfigure the following value: server.errorlog = "/opt/vmware/var/log/lighttpd/error.log"
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None
VCLD-67-000021: VAMI must not have the Web Distributed Authoring (WebDAV) servlet installed.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|awk '/server\.modules/,/\)/'|grep mod_webdav If any value is returned, this is a finding.
Discussion
A web server can be installed with functionality that, by its nature, is not secure. WebDAV is an extension to the HTTP protocol that, when developed, was meant to allow users to create, change, and move documents on a server, typically a web server or web share. Allowing this functionality, development, and deployment is much easier for web authors. WebDAV is not widely used and has serious security concerns because it may allow clients to modify unauthorized files on the web server.
Fix
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Delete or comment out the "mod_webdav" line. The line may be in an included config and not in the parent config.
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None
VCLD-67-000030: VAMI must not be configured to use "mod_status".
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|awk '/server\.modules/,/\)/'|grep mod_status If any value is returned, this is a finding.
Discussion
Any application providing too much information in error logs and in administrative messages to the screen risks compromising the data and security of the application and system. VAMI must only generate error messages that provide information necessary for corrective actions without revealing sensitive or potentially harmful information in error logs and administrative messages. The "mod_status" module generates the status overview of the webserver. The information covers: - uptime - average throughput - current throughput - active connections and their state While this information is useful on a development system, production systems must not have "mod_status" enabled.
Fix
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Remove the line containing "mod_status". The line may be in an included config and not in the parent config itself.
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None
VCLD-67-000033: VAMI must be protected from being stopped by a non-privileged user.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # ps -f -U root | awk '$0 ~ /vami-lighttpd/ && $0 !~ /awk/ {print $1}' Expected result: root If the output does not match the expected result, this is a finding.
Discussion
An attacker has at least two reasons to stop a web server. The first is to cause a denial of service, and the second is to put in place changes the attacker made to the web server configuration. Therefore, only administrators should ever be able to stop VAMI. The VAMI is configured out of the box to be owned by root. This configuration must be verified and maintained.
Fix
Navigate to and open /usr/lib/systemd/system/vami-lighttp.service in a text editor. Under the "[Service]" section, remove the line that beings with "User=". At the command prompt, execute the following command: # service vami-lighttp restart
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None
VCLD-67-000025: VAMI must protect the keystore from unauthorized access.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # stat -c "%n has %a permissions and is owned by %U:%G" /etc/applmgmt/appliance/server.pem Expected result: /etc/applmgmt/appliance/server.pem has 600 permissions and is owned by root:root If the output does not match the expected result, this is a finding.
Discussion
The web server's private key is used to prove the identity of the server to clients and securely exchange the shared secret key used to encrypt communications between the web server and clients. By gaining access to the private key, an attacker can pretend to be an authorized server and decrypt the SSL traffic between a client and the web server.
Fix
At the command prompt, execute the following commands: # chown root:root /etc/applmgmt/appliance/server.pem # chmod 600 /etc/applmgmt/appliance/server.pem
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None
VCLD-67-000006: VAMI must produce log records containing sufficient information to establish what type of events occurred.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # grep "^accesslog.format" /opt/vmware/etc/lighttpd/lighttpd.conf The default commented, accesslog format is acceptable for this requirement. No output should be returned. If the command returns any output, this is a finding.
Discussion
After a security incident has occurred, investigators will often review log files to determine what happened. Understanding what type of event occurred is critical for investigation of a suspicious event. Satisfies: SRG-APP-000095-WSR-000056, SRG-APP-000096-WSR-000057, SRG-APP-000097-WSR-000058, SRG-APP-000098-WSR-000059, SRG-APP-000099-WSR-000061, SRG-APP-000100-WSR-000064, SRG-APP-000374-WSR-000172, SRG-APP-000375-WSR-000171
Fix
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Comment any existing accesslog.format lines by adding a "#" at the beginning of the line.
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None
VCLD-67-000011: VAMI log files must only be accessible by privileged users.
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # stat -c "%n has %a permissions and is owned by %U:%G" /opt/vmware/var/log/lighttpd/*.log Expected result: /opt/vmware/var/log/lighttpd/access.log has 640 permissions and is owned by root:root /opt/vmware/var/log/lighttpd/error.log has 640 permissions and is owned by root:root If the output does not match the expected result, this is a finding.
Discussion
Log data is essential in the investigation of events. If log data were to become compromised, competent forensic analysis and discovery of the true source of potentially malicious system activity would be difficult, if not impossible, to achieve. In addition, access to log records provides information an attacker could potentially use to their advantage since each event record might contain communication ports, protocols, services, trust relationships, user names, etc. Satisfies: SRG-APP-000118-WSR-000068, SRG-APP-000119-WSR-000069, SRG-APP-000120-WSR-000070
Fix
At the command prompt, enter the following command: # chown root:root /opt/vmware/var/log/lighttpd/*.log # chmod 640 /opt/vmware/var/log/lighttpd/*.log
Rating Info
DISA Cat II. NIST impact 3.
Expert Comment
None