Check: VCLD-67-000004
VMware vSphere 6.7 VAMI-lighttpd STIG:
VCLD-67-000004
(in version v1 r1)
Title
VAMI must be configured to monitor remote access. (Cat II impact)
Discussion
Remote access can be exploited by an attacker to compromise the server. By recording all remote access activities, it will be possible to determine the attacker's location, intent, and degree of success. VAMI uses the "mod_accesslog" module to log information relating to remote requests. These logs can then be piped to external monitoring systems. Satisfies: SRG-APP-000016-WSR-000005
Check Content
At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|awk '/server\.modules/,/\)/'|grep mod_accesslog Expected result: "mod_accesslog", If the output does not match the expected result, this is a finding.
Fix Text
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Add the following value in the "server.modules" section: mod_accesslog The result should be similar to the following: server.modules = ( "mod_access", "mod_accesslog", "mod_proxy", "mod_cgi", "mod_rewrite", "mod_magnet", "mod_setenv", # 7 )
Additional Identifiers
Rule ID: SV-239718r679338_rule
Vulnerability ID: V-239718
Group Title: SRG-APP-000016-WSR-000005
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000067 |
The information system monitors remote access methods. |
CCI-001462 |
The information system provides the capability for authorized users to capture/record and log content related to a user session. |