VMware vSphere 7.0 VAMI STIG Version Comparison

There are 2 differences between versions v1 r1 (March 7, 2023) (the "left" version) and v1 r2 (July 26, 2023) (the "right" version).

Check VCLD-70-000007 was changed between these two versions. Green, underlined text was added, red, struck-out text was removed.

The regular view of the left check and right check may be easier to read.

Title

VAMI log files must only be accessible by privileged users.

Check Content

At the command prompt, run the following command: # find stat -c "%n has %a permissions and is owned by %U:%G" /opt/vmware/var/log/lighttpd/*.log Expected /opt/vmware/var/log/lighttpd/ -xdev -type f -a '(' -perm -o+w -o result: /opt/vmware/var/log/lighttpd/access.log has 644 permissions and is owned by root:root /opt/vmware/var/log/lighttpd/error.log has 644 permissions and is owned by root:root If the output does not -not match the expected result, -user root -o -not -group root ')' -exec ls -ld {} \; If any files are returned, this is a finding.

Discussion

Log data is essential in the investigation of events. If log data were to become compromised, competent forensic analysis and discovery of the true source of potentially malicious system activity would be difficult, if not impossible, to achieve. In addition, access to log records provides information an attacker could use to their advantage because each event record might contain communication ports, protocols, services, trust relationships, user names, etc. Satisfies: SRG-APP-000118-WSR-000068, SRG-APP-000119-WSR-000069, SRG-APP-000120-WSR-000070

Fix

At the command prompt, run the following commands: # chmod o-w <file> # chown root:root /opt/vmware/var/log/lighttpd/*.log # chmod 644 /opt/vmware/var/log/lighttpd/*.log <file> Note: Substitute <file> with the listed file.