OpenControls Logo

STIG Viewer

The Security Token Service must generate log records during Java startup and shutdown.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-256750VCST-70-000006SV-256750r918974_ruleCCI-000169medium
Description
Logging must be started as soon as possible when a service starts and as late as possible when a service is stopped. Many forms of suspicious actions can be detected by analyzing logs for unexpected service starts and stops. Also, by starting to log immediately after a service starts, it becomes more difficult for suspicious activity to go unlogged. Satisfies: SRG-APP-000089-WSR-000047, SRG-APP-000092-WSR-000055
STIGDate
VMware vSphere 7.0 vCenter Appliance STS Security Technical Implementation Guide2023-06-15

Related Frameworks

4 paths across 3 frameworks
NIST 800-531 mapping
AU-12
1.00
  • DISA · V1R2 · disa_xccdf · related
  • DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.3.1
1.00
  • DISA · V1R2 · disa_xccdf · related
  • DISA · 2025-01-23 · disa_cci_list · equivalent
  • NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.3.2
1.00
  • DISA · V1R2 · disa_xccdf · related
  • DISA · 2025-01-23 · disa_cci_list · equivalent
  • NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000169
1.00
  • DISA · V1R2 · disa_xccdf · related

Details

Check Text (C-256750r918974_chk)

At the command prompt, run the following command: # grep "1catalina.org.apache.juli.FileHandler" /usr/lib/vmware-sso/vmware-sts/conf/logging.properties Expected result: handlers = 1catalina.org.apache.juli.FileHandler, 2localhost.org.apache.juli.FileHandler, 3manager.org.apache.juli.FileHandler, 4host-manager.org.apache.juli.FileHandler .handlers = 1catalina.org.apache.juli.FileHandler 1catalina.org.apache.juli.FileHandler.level = FINE 1catalina.org.apache.juli.FileHandler.directory = ${catalina.base}/logs/tomcat 1catalina.org.apache.juli.FileHandler.prefix = catalina. 1catalina.org.apache.juli.FileHandler.bufferSize = -1 1catalina.org.apache.juli.FileHandler.formatter = java.util.logging.SimpleFormatter 1catalina.org.apache.juli.FileHandler.maxDays = 10 org.apache.catalina.startup.Catalina.handlers = 1catalina.org.apache.juli.FileHandler If the output does not match the expected result, this is a finding.

Fix Text (F-60368r918973_fix)

Navigate to and open: /usr/lib/vmware-sso/vmware-sts/conf/logging.properties Ensure that the "handlers" and ".handlers" lines are configured as follows: handlers = 1catalina.org.apache.juli.FileHandler, 2localhost.org.apache.juli.FileHandler, 3manager.org.apache.juli.FileHandler, 4host-manager.org.apache.juli.FileHandler .handlers = 1catalina.org.apache.juli.FileHandler 1catalina.org.apache.juli.FileHandler.level = FINE 1catalina.org.apache.juli.FileHandler.directory = ${catalina.base}/logs/tomcat 1catalina.org.apache.juli.FileHandler.prefix = catalina. 1catalina.org.apache.juli.FileHandler.bufferSize = -1 1catalina.org.apache.juli.FileHandler.formatter = java.util.logging.SimpleFormatter 1catalina.org.apache.juli.FileHandler.maxDays = 10 org.apache.catalina.startup.Catalina.handlers = 1catalina.org.apache.juli.FileHandler Restart the service with the following command: # vmon-cli --restart sts