VCLD-67-000004 - VAMI must be configured to monitor remote access.

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Remote access can be exploited by an attacker to compromise the server. By recording all remote access activities, it will be possible to determine the attacker's location, intent, and degree of success.

VAMI uses the 'mod_accesslog' module to log information relating to remote requests. These logs can then be piped to external monitoring systems.

Satisfies: SRG-APP-000016-WSR-000005

Solution

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf.

Add the following value in the 'server.modules' section:

mod_accesslog

The result should be similar to the following:

server.modules = (
'mod_access',
'mod_accesslog',
'mod_proxy',
'mod_cgi',
'mod_rewrite',
'mod_magnet',
'mod_setenv',
# 7
)

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-7_STIG.zip

Item Details

References: CAT|II, CCI|CCI-000067, CCI|CCI-001462, Rule-ID|SV-239718r679338_rule, STIG-ID|VCLD-67-000004, Vuln-ID|V-239718

Plugin: Unix

Control ID: 29b589ce19e0688e6a81cf7577b33906dff6e5b75ccb8ea5e092e9fd106866f6