Detections
Analytics

VCEM-70-000032 - ESX Agent Manager must disable the shutdown port.

Information

An attacker has at least two reasons to stop a web server. The first is to cause a denial of service, and the second is to put in place changes the attacker made to the web server configuration. If the Tomcat shutdown port feature is enabled, a shutdown signal can be sent to the ESX Agent Manager through this port. To ensure availability, the shutdown port must be disabled.

Solution

Navigate to and open:

/etc/vmware-eam/catalina.properties

Add or modify the setting 'base.shutdown.port=-1' in the 'catalina.properties' file.

Restart the service with the following command:

# vmon-cli --restart eam

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_7-0_Y23M07_STIG.zip

Item Details

Category: SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|SC-5, CAT|II, CCI|CCI-002385, Rule-ID|SV-256704r888668_rule, STIG-ID|VCEM-70-000032, Vuln-ID|V-256704

Plugin: Unix

Control ID: 292b1c130775a0bac1940a1f1c663110de0b1a7d310c663da28d3e2e15bea56f