Title

The vCenter STS service logs folder permissions must be set correctly. (Cat II impact)

Discussion

Log data is essential in the investigation of events. The accuracy of the information is always pertinent. One of the first steps an attacker will take is the modification or deletion of log records to cover tracks and prolong discovery. The web server must protect the log data from unauthorized modification. Satisfies: SRG-APP-000118-AS-000078, SRG-APP-000119-AS-000079, SRG-APP-000120-AS-000080

Check Content

At the command prompt, run the following command: # find /var/log/vmware/sso/ -xdev ! -name lookupsvc-init.log ! -name sts-prestart.log -type f -a '(' -perm -o+w -o -not -user sts -o -not -group lwis ')' -exec ls -ld {} \; If any files are returned, this is a finding.

Fix Text

At the command prompt, run the following commands: # chmod o-w <file> # chown sts:lwis <file> Note: Substitute <file> with the listed file.

Additional Identifiers

Rule ID: SV-258975r960930_rule

Vulnerability ID: V-258975

Group Title: SRG-APP-000118-AS-000078

Expert Comments

CCIs tied to check.

Controls tied to check. These are derived from the CCIs shown above.