GEN005460-ESXI5-000060 - The system must only use remote syslog servers (log hosts) justified and documented using site-defined procedures.

Information

If a remote log host is in use and it has not been justified and documented with the IAO, sensitive information could be obtained by unauthorized users without the SA's knowledge. A remote log host is any host to which the system is sending syslog messages over a network.

Solution

Step 1: Verify that the vSphere Syslog Collector syslog host has been configured. If not, install/enable the vSphere Syslog Collector. Step 2: From the vSphere Client: Select the host and click 'Configuration >> Advanced Settings >> Syslog >> Global'. Step 3: Set 'Syslog.global.logHost' to the syslog server hostname justified and documented with the IAO.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_ESXi5_Server_V2R1_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Group-ID|V-39278, Rule-ID|SV-250589r798766_rule, STIG-ID|GEN005460-ESXI5-000060, STIG-Legacy|SV-51094, STIG-Legacy|V-39278, Vuln-ID|V-250589

Plugin: VMware

Control ID: 4c39dac6bd2303fa63c2b9b2978479dfef6f0305877981aff1df95bc356f882d