Lighttpd must be configured to use mod_accesslog.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-240218	VRAU-LI-000025	SV-240218r879521_rule		Medium

Description
Lighttpd is the administration panel for vRealize Automation. Because it is intended to provide remote access to the appliance, vRA must provide remote access information to external monitoring systems. mod_accesslog is the module in Lighttpd that configures Lighttpd to share information with external monitoring systems.

STIG	Date
VMware vRealize Automation 7.x Lighttpd Security Technical Implementation Guide	2023-09-12

Details

Check Text ( C-43451r667829_chk )
At the command prompt, execute the following command: cat /opt/vmware/etc/lighttpd/lighttpd.conf | awk '/server\.modules/,/\)/' If the value "mod_accesslog" is not listed, this is a finding.

Fix Text (F-43410r667830_fix)
Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf Navigate to and configure the "server.modules" section with the following value: mod_accesslog