The rhttpproxy must have logging enabled.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-240721 | VCRP-67-000006 | SV-240721r679676_rule | Medium |
| Description |
|---|
| After a security incident has occurred, investigators will often review log files to determine what happened. The rhttpproxy must create logs upon service startup to capture information relevant to investigations. |
| STIG | Date |
|---|---|
| VMware vSphere 6.7 RhttpProxy Security Technical Implementation Guide | 2021-03-19 |
Details
| Check Text ( C-43954r679674_chk ) |
|---|
| At the command prompt, execute the following command: # xmllint --xpath '/config/log/outputToFiles' /etc/vmware-rhttpproxy/config.xml Expected result: If the output does not match the expected result, this is a finding. |
| Fix Text (F-43913r679675_fix) |
|---|
| Navigate to and open /etc/vmware-rhttpproxy/config.xml. Locate the Restart the service for changes to take effect. # vmon-cli --restart rhttpproxy |