VCST-70-000006 - The Security Token Service must generate log records during Java startup and shutdown. - bufferSize

Information

Logging must be started as soon as possible when a service starts and as late as possible when a service is stopped. Many forms of suspicious actions can be detected by analyzing logs for unexpected service starts and stops. Also, by starting to log immediately after a service starts, it becomes more difficult for suspicious activity to go unlogged.

Satisfies: SRG-APP-000089-WSR-000047, SRG-APP-000092-WSR-000055

Solution

Navigate to and open:

/usr/lib/vmware-sso/vmware-sts/conf/logging.properties

Ensure that the 'handlers' and '.handlers' lines are configured as follows:

handlers = 1catalina.org.apache.juli.FileHandler, 2localhost.org.apache.juli.FileHandler, 3manager.org.apache.juli.FileHandler, 4host-manager.org.apache.juli.FileHandler
.handlers = 1catalina.org.apache.juli.FileHandler
1catalina.org.apache.juli.FileHandler.level = FINE
1catalina.org.apache.juli.FileHandler.directory = ${catalina.base}/logs/tomcat
1catalina.org.apache.juli.FileHandler.prefix = catalina.
1catalina.org.apache.juli.FileHandler.bufferSize = -1
1catalina.org.apache.juli.FileHandler.formatter = java.util.logging.SimpleFormatter
1catalina.org.apache.juli.FileHandler.maxDays = 10
org.apache.catalina.startup.Catalina.handlers = 1catalina.org.apache.juli.FileHandler

Restart the service with the following command:

# vmon-cli --restart sts

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_7-0_Y23M07_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12a., 800-53|AU-14(1), CAT|II, CCI|CCI-000169, CCI|CCI-001464, Rule-ID|SV-256750r918974_rule, STIG-ID|VCST-70-000006, Vuln-ID|V-256750

Plugin: Unix

Control ID: 2c231031c27f76fcb69c62da4e4120dfe3ac24d5f5574469c80f17e7af6ff8c3