Detections
Analytics
VCLD-67-000005 - VAMI must generate log records for system startup and shutdown.
Information
Logging must be started as soon as possible when a service starts and when a service is stopped. Many forms of suspicious actions can be detected by analyzing logs for unexpected service starts and stops. Also, by starting to log immediately after a service starts, it becomes more difficult for suspicious activity to go unlogged.Solution
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf.Add or reconfigure the following value:
server.errorlog = '/opt/vmware/var/log/lighttpd/error.log'
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-7_Y23M07_STIG.zip
Item Details
Audit Name: DISA STIG VMware vSphere 6.7 VAMI-lighttpd v1r3
Category: AUDIT AND ACCOUNTABILITY
References: 800-53|AU-12a., CAT|II, CCI|CCI-000169, Rule-ID|SV-239719r879559_rule, STIG-ID|VCLD-67-000005, Vuln-ID|V-239719
Plugin: Unix
Control ID: 9600e05afbb001f936f6657a5aa82668781b66d9224b68c4ead04c9bd806f7bf