UCF STIG Viewer Logo

The vCenter VAMI service must restrict the ability of users to launch Denial of Service (DoS) attacks against other information systems or networks.


Finding ID Version Rule ID IA Controls Severity
V-259149 VCLD-80-000060 SV-259149r935351_rule Medium
In UNIX and related computer operating systems, a file descriptor is an indicator used to access a file or other input/output resource, such as a pipe or network connection. File descriptors index into a per-process file descriptor table maintained by the kernel, which in turn indexes into a systemwide table of files opened by all processes, called the file table. As a single-threaded server, Lighttpd must be limited in the number of file descriptors that can be allocated. This will prevent Lighttpd from being used in a form of DoS attack against the operating system.
VMware vSphere 8.0 vCenter Appliance Management Interface (VAMI) Security Technical Implementation Guide 2023-10-29


Check Text ( C-62889r935349_chk )
At the command prompt, run the following command:

# /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2>/dev/null|grep "server.max-fds"

Expected result:


If the output does not match the expected result, this is a finding.

Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details:

Fix Text (F-62798r935350_fix)
Navigate to and open:


Add or reconfigure the following value:

server.max-fds = 2048

Restart the service with the following command:

# vmon-cli --restart applmgmt