Lighttpd must be configured to use mod_accesslog.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-89225	VRAU-LI-000025	SV-99875r1_rule		Medium

Description
Lighttpd is the administration panel for vRealize Automation. Because it is intended to provide remote access to the appliance, vRA must provide remote access information to external monitoring systems. mod_accesslog is the module in Lighttpd that configures Lighttpd to share information with external monitoring systems.

STIG	Date
VMware vRealize Automation 7.x Lighttpd Security Technical Implementation Guide	2018-10-12

Details

Check Text ( C-88917r1_chk )
At the command prompt, execute the following command: cat /opt/vmware/etc/lighttpd/lighttpd.conf | awk '/server\.modules/,/\)/' If the value "mod_accesslog" is not listed, this is a finding.

Fix Text (F-95967r1_fix)
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf Navigate to and configure the "server.modules" section with the following value: mod_accesslog