VCLD-70-000004 - VAMI must be configured to monitor remote access.

Information

Remote access can be exploited by an attacker to compromise the server. By recording all remote access activities, it will be possible to determine the attacker's location, intent, and degree of success.

VAMI uses the 'mod_accesslog' module to log information relating to remote requests. These logs can then be piped to external monitoring systems.

Satisfies: SRG-APP-000016-WSR-000005, SRG-APP-000093-WSR-000053

Solution

Navigate to and open:

/opt/vmware/etc/lighttpd/lighttpd.conf

Add the following value in the 'server.modules' section:

mod_accesslog

The result should be similar to the following:

server.modules = (
'mod_access',
'mod_accesslog',
'mod_proxy',
'mod_cgi',
'mod_rewrite',
'mod_magnet',
'mod_setenv',
)

Restart the service with the following command:

# vmon-cli --restart applmgmt

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_7-0_Y23M07_STIG.zip

Item Details

Category: ACCESS CONTROL, AUDIT AND ACCOUNTABILITY

References: 800-53|AC-17(1), 800-53|AU-14(2), CAT|II, CCI|CCI-000067, CCI|CCI-001462, Rule-ID|SV-256648r888466_rule, STIG-ID|VCLD-70-000004, Vuln-ID|V-256648

Plugin: Unix

Control ID: e03bb127f79c90e83bb52a6133e07ae20b3705471770ddea48e1bdc29fa7c07a