VCRP-67-000005 - The rhttpproxy must produce log records containing sufficient information to establish the source of events.

Information

After a security incident has occurred, investigators will often review log files to determine what happened, and determining the source of an event is crucial for forensics. The rhttpproxy must be configured for verbose logging to capture client IP addresses and the associated actions.

Solution

Navigate to and open /etc/vmware-rhttpproxy/config.xml.

Locate the <config>/<log> block and configure <level> as follows:

<level>verbose</level>

Restart the service for changes to take effect.

# vmon-cli --restart rhttpproxy

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-7_Y23M07_STIG.zip

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-17(1), CAT|II, CCI|CCI-000067, Rule-ID|SV-240720r879521_rule, STIG-ID|VCRP-67-000005, Vuln-ID|V-240720

Plugin: Unix

Control ID: d20c7ae27d9392d5308d5bc6df3b1504b7e3ccf1162cfc7955d1861629c99161