Detections
Analytics
VCST-67-000006 - The Security Token Service must generate log records during Java startup and shutdown - handlers
Information
Logging must be started as soon as possible when a service starts and as late as possible when a service is stopped. Many forms of suspicious actions can be detected by analyzing logs for unexpected service starts and stops. Also, by starting to log immediately after a service starts, it becomes more difficult for suspicious activity to go unlogged.Solution
Navigate to and open /usr/lib/vmware-sso/vmware-sts/conf/logging.properties.Ensure that the 'handlers' and '.handlers' lines are configured as follows:
handlers = 1catalina.org.apache.juli.FileHandler, 2localhost.org.apache.juli.FileHandler, 3manager.org.apache.juli.FileHandler, 4host-manager.org.apache.juli.FileHandler, java.util.logging.ConsoleHandler
.handlers = 1catalina.org.apache.juli.FileHandler
Ensure that the following lines are present:
1catalina.org.apache.juli.FileHandler.level = FINE
1catalina.org.apache.juli.FileHandler.directory = ${catalina.base}/logs
1catalina.org.apache.juli.FileHandler.prefix = catalina.
1catalina.org.apache.juli.FileHandler.bufferSize = -1
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-7_STIG.zip
Item Details
Audit Name: DISA STIG VMware vSphere 6.7 STS Tomcat v1r1
References: CAT|II, CCI|CCI-000169, Rule-ID|SV-239657r679043_rule, STIG-ID|VCST-67-000006, Vuln-ID|V-239657
Plugin: Unix
Control ID: 8894000a8558ca78d5b6688a54e3f1275fadbaafcb1e3cbcd75f0ecb773c7487