VCLU-70-000010 - Lookup Service must not be configured with the 'UserDatabaseRealm' enabled.

Information

The Lookup Service performs user authentication at the application level and not through Tomcat. By default, there is no configuration for the 'UserDatabaseRealm' Tomcat authentication mechanism. As part of eliminating unnecessary features and to ensure the Lookup Service remains in its shipping state, the lack of a 'UserDatabaseRealm' configuration must be confirmed.

Solution

Navigate to and open:

/usr/lib/vmware-lookupsvc/conf/server.xml

Remove all <Realm> nodes.

Restart the service with the following command:

# vmon-cli --restart lookupsvc

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_7-0_Y23M07_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7a., CAT|II, CCI|CCI-000381, Rule-ID|SV-256715r888736_rule, STIG-ID|VCLU-70-000010, Vuln-ID|V-256715

Plugin: Unix

Control ID: 589e353a596a4b9e1d7079f0ecd11dba9e954e3047083b53a1355bf0f2705734