The vCenter ESX Agent Manager service must produce log records containing sufficient information regarding event details.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-259006	VCEM-80-000014	SV-259006r934676_rule		Medium

Description
Remote access can be exploited by an attacker to compromise the server. By recording all remote access activities, it will be possible to determine the attacker's location, intent, and degree of success. Tomcat can be configured with an "AccessLogValve", a component that can be inserted into the request processing pipeline to provide robust access logging. The "AccessLogValve" creates log files in the same format as those created by standard web servers. When "AccessLogValve" is properly configured, log files will contain all the forensic information necessary in the case of a security incident. Satisfies: SRG-APP-000095-AS-000056, SRG-APP-000016-AS-000013, SRG-APP-000080-AS-000045, SRG-APP-000089-AS-000050, SRG-APP-000090-AS-000051, SRG-APP-000091-AS-000052, SRG-APP-000096-AS-000059, SRG-APP-000097-AS-000060, SRG-APP-000098-AS-000061, SRG-APP-000099-AS-000062, SRG-APP-000100-AS-000063, SRG-APP-000343-AS-000030, SRG-APP-000375-AS-000211, SRG-APP-000495-AS-000220, SRG-APP-000499-AS-000224, SRG-APP-000503-AS-000228

Description

Remote access can be exploited by an attacker to compromise the server. By recording all remote access activities, it will be possible to determine the attacker's location, intent, and degree of success. Tomcat can be configured with an "AccessLogValve", a component that can be inserted into the request processing pipeline to provide robust access logging. The "AccessLogValve" creates log files in the same format as those created by standard web servers. When "AccessLogValve" is properly configured, log files will contain all the forensic information necessary in the case of a security incident. Satisfies: SRG-APP-000095-AS-000056, SRG-APP-000016-AS-000013, SRG-APP-000080-AS-000045, SRG-APP-000089-AS-000050, SRG-APP-000090-AS-000051, SRG-APP-000091-AS-000052, SRG-APP-000096-AS-000059, SRG-APP-000097-AS-000060, SRG-APP-000098-AS-000061, SRG-APP-000099-AS-000062, SRG-APP-000100-AS-000063, SRG-APP-000343-AS-000030, SRG-APP-000375-AS-000211, SRG-APP-000495-AS-000220, SRG-APP-000499-AS-000224, SRG-APP-000503-AS-000228

STIG	Date
VMware vSphere 8.0 vCenter Appliance ESX Agent Manager (EAM) Security Technical Implementation Guide	2023-10-29

Details

Check Text ( C-62746r934674_chk )
At the command prompt, run the following command: # xmllint --xpath '/Server/Service/Engine/Host/Valve[@className="org.apache.catalina.valves.AccessLogValve"]/@pattern' /usr/lib/vmware-eam/web/conf/server.xml Example result: pattern="%h %{X-Forwarded-For}i %l %u %t [%I] "%r" %s %b [Processing time %D msec] "%{User-Agent}i"" Required elements: %h %{X-Forwarded-For}i %l %t %u "%r" %s %b If the log pattern does not contain the required elements in any order, this is a finding.

Check Text ( C-62746r934674_chk )

At the command prompt, run the following command:

# xmllint --xpath '/Server/Service/Engine/Host/Valve[@className="org.apache.catalina.valves.AccessLogValve"]/@pattern' /usr/lib/vmware-eam/web/conf/server.xml

Example result:

pattern="%h %{X-Forwarded-For}i %l %u %t [%I] "%r" %s %b [Processing time %D msec] "%{User-Agent}i""

Required elements:

%h %{X-Forwarded-For}i %l %t %u "%r" %s %b

If the log pattern does not contain the required elements in any order, this is a finding.

Fix Text (F-62655r934675_fix)
Navigate to and open: /usr/lib/vmware-eam/web/conf/server.xml Inside the node, find the "AccessLogValve" node and replace the "pattern" element as follows: pattern="%h %{X-Forwarded-For}i %l %u %t [%I] "%r" %s %b [Processing time %D msec] "%{User-Agent}i"" Restart the service with the following command: # vmon-cli --restart eam