The Security Token Service must record user access in a format that enables monitoring of remote access.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-239656	VCST-67-000005	SV-239656r816693_rule		Medium

Description
Remote access can be exploited by an attacker to compromise the server. By recording all remote access activities, it will be possible to determine the attacker's location, intent, and degree of success. Tomcat can be configured with an "AccessLogValve", a component that can be inserted into the request processing pipeline to provide robust access logging. The AccessLogValve creates log files in the same format as those created by standard web servers. When AccessLogValve is properly configured, log files will contain all the forensic information necessary in the case of a security incident. Satisfies: SRG-APP-000016-WSR-000005, SRG-APP-000089-WSR-000047, SRG-APP-000095-WSR-000056, SRG-APP-000096-WSR-000057, SRG-APP-000097-WSR-000058, SRG-APP-000098-WSR-000059, SRG-APP-000098-WSR-000060, SRG-APP-000099-WSR-000061, SRG-APP-000100-WSR-000064, SRG-APP-000092-WSR-000055, SRG-APP-000374-WSR-000172, SRG-APP-000375-WSR-000171

Description

Remote access can be exploited by an attacker to compromise the server. By recording all remote access activities, it will be possible to determine the attacker's location, intent, and degree of success. Tomcat can be configured with an "AccessLogValve", a component that can be inserted into the request processing pipeline to provide robust access logging. The AccessLogValve creates log files in the same format as those created by standard web servers. When AccessLogValve is properly configured, log files will contain all the forensic information necessary in the case of a security incident. Satisfies: SRG-APP-000016-WSR-000005, SRG-APP-000089-WSR-000047, SRG-APP-000095-WSR-000056, SRG-APP-000096-WSR-000057, SRG-APP-000097-WSR-000058, SRG-APP-000098-WSR-000059, SRG-APP-000098-WSR-000060, SRG-APP-000099-WSR-000061, SRG-APP-000100-WSR-000064, SRG-APP-000092-WSR-000055, SRG-APP-000374-WSR-000172, SRG-APP-000375-WSR-000171

STIG	Date
VMware vSphere 6.7 STS Tomcat Security Technical Implementation Guide	2022-01-03

Details

Check Text ( C-42889r816691_chk )
Connect to the PSC, whether external or embedded. At the command prompt, execute the following command: # xmllint --format /usr/lib/vmware-sso/vmware-sts/conf/server.xml \| sed '2 s/xmlns=".*"//g' \| xmllint --xpath '/Server/Service/Engine/Host/Valve[@className="org.apache.catalina.valves.AccessLogValve"]'/@pattern - Expected result: pattern="%h %{X-Forwarded-For}i %l %u %t "%r" %s %b "%{User-Agent}i"" If the output does not match the expected result, this is a finding.

Check Text ( C-42889r816691_chk )

Connect to the PSC, whether external or embedded.

At the command prompt, execute the following command:

# xmllint --format /usr/lib/vmware-sso/vmware-sts/conf/server.xml | sed '2 s/xmlns=".*"//g' | xmllint --xpath '/Server/Service/Engine/Host/Valve[@className="org.apache.catalina.valves.AccessLogValve"]'/@pattern -

Expected result:

pattern="%h %{X-Forwarded-For}i %l %u %t "%r" %s %b "%{User-Agent}i""

If the output does not match the expected result, this is a finding.

Fix Text (F-42848r816692_fix)
Connect to the PSC, whether external or embedded. Navigate to and open /usr/lib/vmware-sso/vmware-sts/conf/server.xml. Inside the node, add the "AccessLogValve" node entirely if it does not exist or update the existing pattern to match the following line: