Detections
Analytics
VCLD-67-000004 - VAMI must be configured to monitor remote access.
Information
Remote access can be exploited by an attacker to compromise the server. By recording all remote access activities, it will be possible to determine the attacker's location, intent, and degree of success.VAMI uses the 'mod_accesslog' module to log information relating to remote requests. These logs can then be piped to external monitoring systems.
Satisfies: SRG-APP-000016-WSR-000005
Solution
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf.Add the following value in the 'server.modules' section:
mod_accesslog
The result should be similar to the following:
server.modules = (
'mod_access',
'mod_accesslog',
'mod_proxy',
'mod_cgi',
'mod_rewrite',
'mod_magnet',
'mod_setenv',
# 7
)
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-7_Y22M10_STIG.zip
Item Details
Audit Name: DISA STIG VMware vSphere 6.7 VAMI-lighttpd v1r2
References: CAT|II, CCI|CCI-000067, CCI|CCI-001462, Rule-ID|SV-239718r816785_rule, STIG-ID|VCLD-67-000004, Vuln-ID|V-239718
Plugin: Unix
Control ID: 905b76d7f2ef0d39aeb3a2c56aacb7a833fe4b68619aca5bfa5a80d5bd4a98bf