VCLD-80-000060 The vCenter VAMI service must restrict the ability of users to launch denial-of-service (DoS) attacks against other information systems or networks.

Information

In UNIX and related computer operating systems, a file descriptor is an indicator used to access a file or other input/output resource, such as a pipe or network connection. File descriptors index into a per-process file descriptor table maintained by the kernel, which in turn indexes into a systemwide table of files opened by all processes, called the file table.

As a single-threaded server, Lighttpd must be limited in the number of file descriptors that can be allocated. This will prevent Lighttpd from being used in a form of DoS attack against the operating system.

Solution

Navigate to and open:

/var/lib/vmware/cap-lighttpd/lighttpd.conf

Add or reconfigure the following value:

server.max-fds = 2048

Restart the service with the following command:

# systemctl restart cap-lighttpd

Item Details

Audit Name: DISA VMware vSphere 8.0 vCenter Appliance Management Interface (VAMI) STIG v2r1

Category: SYSTEM AND COMMUNICATIONS PROTECTION

Plugin: Unix

Control ID: 2818b254f31679879fff13df57abe0c216cf91c261214dbac25430c8c803bf4f

Detections

Analytics

VCLD-80-000060 The vCenter VAMI service must restrict the ability of users to launch denial-of-service (DoS) attacks against other information systems or networks.

Information

Solution

See Also

Item Details