VCLD-67-000004 - VAMI must be configured to monitor remote access.

Information

Remote access can be exploited by an attacker to compromise the server. By recording all remote access activities, it will be possible to determine the attacker's location, intent, and degree of success.

VAMI uses the 'mod_accesslog' module to log information relating to remote requests. These logs can then be piped to external monitoring systems.

Satisfies: SRG-APP-000016-WSR-000005

Solution

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf.

Add the following value in the 'server.modules' section:

mod_accesslog

The result should be similar to the following:

server.modules = (
'mod_access',
'mod_accesslog',
'mod_proxy',
'mod_cgi',
'mod_rewrite',
'mod_magnet',
'mod_setenv',
# 7
)

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-7_Y23M07_STIG.zip

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

References: 800-53|AC-17(1), 800-53|AU-14(2), CAT|II, CCI|CCI-000067, CCI|CCI-001462, Rule-ID|SV-239718r879521_rule, STIG-ID|VCLD-67-000004, Vuln-ID|V-239718

Plugin: Unix

Control ID: 45197b1580bf8dde524c7ac69335a6dd3b99d846644c2933e9a32bb58999bf93