Changes are coming to https://stigviewer.com.
Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey
The rhttpproxy must produce log records containing sufficient information to establish the source of events.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-240720 | VCRP-67-000005 | SV-240720r679673_rule | Medium |
| Description |
|---|
| After a security incident has occurred, investigators will often review log files to determine what happened, and determining the source of an event is crucial for forensics. The rhttpproxy must be configured for verbose logging to capture client IP addresses and the associated actions. |
| STIG | Date |
|---|---|
| VMware vSphere 6.7 RhttpProxy Security Technical Implementation Guide | 2022-01-03 |
Details
| Check Text ( C-43953r679671_chk ) |
|---|
| At the command prompt, execute the following command: # xmllint --xpath '/config/log/level' /etc/vmware-rhttpproxy/config.xml Expected result: If the output does not match the expected result, this is a finding. |
| Fix Text (F-43912r679672_fix) |
|---|
| Navigate to and open /etc/vmware-rhttpproxy/config.xml. Locate the Restart the service for changes to take effect. # vmon-cli --restart rhttpproxy |