Check: VCLD-67-000004
VMware vSphere 6.7 VAMI-lighttpd STIG:
VCLD-67-000004
(in versions v1 r3 through v1 r2)
Title
VAMI must be configured to monitor remote access. (Cat II impact)
Discussion
Remote access can be exploited by an attacker to compromise the server. By recording all remote access activities, it will be possible to determine the attacker's location, intent, and degree of success. VAMI uses the "mod_accesslog" module to log information relating to remote requests. These logs can then be piped to external monitoring systems. Satisfies: SRG-APP-000016-WSR-000005
Check Content
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|awk '/server\.modules/,/\)/'|grep mod_accesslog Expected result: "mod_accesslog", If the output does not match the expected result, this is a finding.
Fix Text
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Add the following value in the "server.modules" section: mod_accesslog The result should be similar to the following: server.modules = ( "mod_access", "mod_accesslog", "mod_proxy", "mod_cgi", "mod_rewrite", "mod_magnet", "mod_setenv", # 7 )
Additional Identifiers
Rule ID: SV-239718r879521_rule
Vulnerability ID: V-239718
Group Title: SRG-APP-000016-WSR-000005
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000067 |
The information system monitors remote access methods. |
CCI-001462 |
The information system provides the capability for authorized users to capture/record and log content related to a user session. |