Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-239657 | VCST-67-000006 | SV-239657r679043_rule | Medium |
Description |
---|
Logging must be started as soon as possible when a service starts and as late as possible when a service is stopped. Many forms of suspicious actions can be detected by analyzing logs for unexpected service starts and stops. Also, by starting to log immediately after a service starts, it becomes more difficult for suspicious activity to go unlogged. |
STIG | Date |
---|---|
VMware vSphere 6.7 STS Tomcat Security Technical Implementation Guide | 2021-04-15 |
Check Text ( C-42890r679041_chk ) |
---|
At the command prompt, execute the following command: # grep "1catalina.org.apache.juli.FileHandler" /usr/lib/vmware-sso/vmware-sts/conf/logging.properties Expected result: handlers = 1catalina.org.apache.juli.FileHandler, 2localhost.org.apache.juli.FileHandler, 3manager.org.apache.juli.FileHandler, 4host-manager.org.apache.juli.FileHandler, java.util.logging.ConsoleHandler .handlers = 1catalina.org.apache.juli.FileHandler 1catalina.org.apache.juli.FileHandler.level = FINE 1catalina.org.apache.juli.FileHandler.directory = ${catalina.base}/logs 1catalina.org.apache.juli.FileHandler.prefix = catalina. 1catalina.org.apache.juli.FileHandler.bufferSize = -1 If the output does not match the expected result, this is a finding. |
Fix Text (F-42849r679042_fix) |
---|
Navigate to and open /usr/lib/vmware-sso/vmware-sts/conf/logging.properties. Ensure that the "handlers" and ".handlers" lines are configured as follows: handlers = 1catalina.org.apache.juli.FileHandler, 2localhost.org.apache.juli.FileHandler, 3manager.org.apache.juli.FileHandler, 4host-manager.org.apache.juli.FileHandler, java.util.logging.ConsoleHandler .handlers = 1catalina.org.apache.juli.FileHandler Ensure that the following lines are present: 1catalina.org.apache.juli.FileHandler.level = FINE 1catalina.org.apache.juli.FileHandler.directory = ${catalina.base}/logs 1catalina.org.apache.juli.FileHandler.prefix = catalina. 1catalina.org.apache.juli.FileHandler.bufferSize = -1 |