UCF STIG Viewer Logo

The vAMI must protect log information from unauthorized read access.


Overview

Finding ID Version Rule ID IA Controls Severity
V-90203 VRAU-VA-000130 SV-100853r1_rule Medium
Description
If log data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. In addition, access to log records provides information an attacker could potentially use to his or her advantage. Application servers contain admin interfaces that allow reading and manipulation of log records. Therefore, these interfaces should not allow unfettered access to those records. Application servers also write log data to log files that are stored on the OS, so appropriate file permissions must also be used to restrict access. Log information includes all information (e.g., log records, log settings, transaction logs, and log reports) needed to successfully log information system activity. Application servers must protect log information from unauthorized read access.
STIG Date
VMW vRealize Automation 7.x vAMI Security Technical Implementation Guide 2018-10-12

Details

Check Text ( C-89895r1_chk )
At the command prompt, execute the following command:

ls -lL /opt/vmware/var/log/vami /opt/vmware/var/log/sfcb

If any log files are world-readable, this is a finding.
Fix Text (F-96945r2_fix)
At the command prompt, enter the following command:

chmod 640

Note: Replace with the file(s) with world-read rights.