UCF STIG Viewer Logo
Changes are coming to https://stigviewer.com. Take our survey to help us understand your usage and how we can better serve you in the future.
Take Survey

VAMI must be configured to monitor remote access.


Overview

Finding ID Version Rule ID IA Controls Severity
V-239718 VCLD-67-000004 SV-239718r816785_rule Medium
Description
Remote access can be exploited by an attacker to compromise the server. By recording all remote access activities, it will be possible to determine the attacker's location, intent, and degree of success. VAMI uses the "mod_accesslog" module to log information relating to remote requests. These logs can then be piped to external monitoring systems. Satisfies: SRG-APP-000016-WSR-000005
STIG Date
VMware vSphere 6.7 VAMI-lighttpd Security Technical Implementation Guide 2022-01-03

Details

Check Text ( C-42951r816784_chk )
Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash".

At the command prompt, execute the following command:

# /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|awk '/server\.modules/,/\)/'|grep mod_accesslog

Expected result:

"mod_accesslog",

If the output does not match the expected result, this is a finding.
Fix Text (F-42910r679263_fix)
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf.

Add the following value in the "server.modules" section:

mod_accesslog

The result should be similar to the following:

server.modules = (
"mod_access",
"mod_accesslog",
"mod_proxy",
"mod_cgi",
"mod_rewrite",
"mod_magnet",
"mod_setenv",
# 7
)