UCF STIG Viewer Logo

vSphere UI must record user access in a format that enables monitoring of remote access.


Overview

Finding ID Version Rule ID IA Controls Severity
V-256782 VCUI-70-000005 SV-256782r889345_rule Medium
Description
Remote access can be exploited by an attacker to compromise the server. By recording all remote access activities, it will be possible to determine the attacker's location, intent, and degree of success. Tomcat can be configured with an "AccessLogValve", a component that can be inserted into the request processing pipeline to provide robust access logging. The "AccessLogValve" creates log files in the same format as those created by standard web servers. When "AccessLogValve" is properly configured, log files will contain all the forensic information necessary in the case of a security incident. Satisfies: SRG-APP-000016-WSR-000005, SRG-APP-000089-WSR-000047, SRG-APP-000093-WSR-000053, SRG-APP-000095-WSR-000056, SRG-APP-000096-WSR-000057, SRG-APP-000097-WSR-000058, SRG-APP-000098-WSR-000059, SRG-APP-000098-WSR-000060, SRG-APP-000099-WSR-000061, SRG-APP-000100-WSR-000064, SRG-APP-000374-WSR-000172, SRG-APP-000375-WSR-000171
STIG Date
VMware vSphere 7.0 vCenter Appliance UI Security Technical Implementation Guide 2023-02-21

Details

Check Text ( C-60457r889343_chk )
At the command prompt, run the following command:

# xmllint --format /usr/lib/vmware-vsphere-ui/server/conf/server.xml | xmllint --xpath '/Server/Service/Engine/Host/Valve[@className="org.apache.catalina.valves.AccessLogValve"]/@pattern' -

Expected result:

pattern="%h %{x-forwarded-for}i %l %u %t "%r" %s %b %{#hashedClientId#}s %{#hashedRequestId#}r %I %D"

If the output does not match the expected result, this is a finding.
Fix Text (F-60400r889344_fix)
Navigate to and open:

/usr/lib/vmware-vsphere-ui/server/conf/server.xml

Ensure the log pattern in the "org.apache.catalina.valves.AccessLogValve" node is set to the following:

pattern="%h %{x-forwarded-for}i %l %u %t "%r" %s %b %{#hashedClientId#}s %{#hashedRequestId#}r %I %D"

Restart the service with the following command:

# vmon-cli --restart vsphere-ui