Cyber · Trackr The Free Compliance Library
⌘K
DoD Compliance · STIG

VMware vSphere 6.7 VAMI-lighttpd Security Technical Implementation Guide

V1R3 · · · Released 26 Jul 2023 · 28 rules
Compare

Pick two releases to diff their requirements.

View

Open a previous version of this STIG.

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.
Digest of Updates vs. V1R2 · 08 Feb 2022 +1

Comparison against the immediately-prior release (V1R2). Rule matching uses the Group Vuln ID. Content-change detection compares the rule’s description, check, and fix text after stripping inline markup — cosmetic-only edits aren’t flagged.

Added rules 1

  • V-257285 High The version of VAMI-lighttpd running on the system must be a supported version.
Sort by
b
VAMI must limit the number of simultaneous requests.
AC-10 - Medium - CCI-000054 - V-239715 - SV-239715r879511_rule
RMF Control
AC-10
Severity
M
CCI
CCI-000054
Version
VCLD-67-000001
Vuln IDs
  • V-239715
Rule IDs
  • SV-239715r879511_rule
Denial of service (DoS) is one threat against web servers. Many DoS attacks attempt to consume web server resources in such a way that no more resources are available to satisfy legitimate requests. Mitigation against these threats is to take steps to limit the number of resources that can be consumed in certain ways. VAMI provides the "maxConnections" attribute of the to limit the number of concurrent TCP connections. This comes preconfigured with a tested, supported value that must be verified and maintained.
Checks: C-42948r816778_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # grep "server.max-connections = 1024" /opt/vmware/etc/lighttpd/lighttpd.conf Expected result: server.max-connections = 1024 If the output does not match the expected result, this is a finding.

Fix: F-42907r679254_fix

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Add or reconfigure the following value: server.max-connections = 1024

c
VAMI must be configured with FIPS 140-2 compliant ciphers for HTTPS connections.
AC-17 - High - CCI-000068 - V-239716 - SV-239716r879519_rule
RMF Control
AC-17
Severity
H
CCI
CCI-000068
Version
VCLD-67-000002
Vuln IDs
  • V-239716
Rule IDs
  • SV-239716r879519_rule
Encryption of data in flight is an essential element of protecting information confidentiality. If a web server uses weak or outdated encryption algorithms, the server's communications can potentially be compromised. The U.S. Federal Information Processing Standards (FIPS) publication 140-2, Security Requirements for Cryptographic Modules (FIPS 140-2), identifies 11 areas for a cryptographic module used inside a security system that protects information. FIPS 140-2 approved ciphers provide the maximum level of encryption possible for a private web server. VAMI is compiled to use VMware's FIPS-validated OpenSSL module and cannot be configured otherwise. Ciphers may still be specified in order of preference, but no non-FIPS-approved ciphers will be implemented. Satisfies: SRG-APP-000014-WSR-000006, SRG-APP-000179-WSR-000111, SRG-APP-000416-WSR-000118, SRG-APP-000439-WSR-000188
Checks: C-42949r816780_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|grep "ssl.cipher-list" Expected result: ssl.cipher-list = "!aNULL:kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH+AES:RSA+AES" If the output does not match the expected result, this is a finding.

Fix: F-42908r679257_fix

Navigate to and open /etc/applmgmt/appliance/lighttpd.conf. Add or reconfigure the following value: ssl.cipher-list = "!aNULL:kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH+AES:RSA+AES"

b
VAMI must use cryptography to protect the integrity of remote sessions.
IA-5 - Medium - CCI-000197 - V-239717 - SV-239717r879520_rule
RMF Control
IA-5
Severity
M
CCI
CCI-000197
Version
VCLD-67-000003
Vuln IDs
  • V-239717
Rule IDs
  • SV-239717r879520_rule
Data exchanged between the user and the web server can range from static display data to credentials used to log in to the hosted application. Even when data appears to be static, the non-displayed logic in a web page may expose business logic or trusted system relationships. The integrity of all the data being exchanged between the user and web server must always be trusted. To protect the integrity and trust, encryption methods should be used to protect the complete communication session. To protect the integrity and confidentiality of the remote sessions, VAMI uses SSL/TLS. Satisfies: SRG-APP-000015-WSR-000014, SRG-APP-000172-WSR-000104, SRG-APP-000315-WSR-000003, SRG-APP-000141-WSR-000076, SRG-APP-000439-WSR-000151, SRG-APP-000439-WSR-000152, SRG-APP-000442-WSR-000182
Checks: C-42950r816782_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|grep "ssl.engine" Expected result: ssl.engine = "enable" If the output does not match the expected result, this is a finding.

Fix: F-42909r679260_fix

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Add or reconfigure the following value: ssl.engine = "enable"

b
VAMI must be configured to monitor remote access.
AC-17 - Medium - CCI-000067 - V-239718 - SV-239718r879521_rule
RMF Control
AC-17
Severity
M
CCI
CCI-000067
Version
VCLD-67-000004
Vuln IDs
  • V-239718
Rule IDs
  • SV-239718r879521_rule
Remote access can be exploited by an attacker to compromise the server. By recording all remote access activities, it will be possible to determine the attacker's location, intent, and degree of success. VAMI uses the "mod_accesslog" module to log information relating to remote requests. These logs can then be piped to external monitoring systems. Satisfies: SRG-APP-000016-WSR-000005
Checks: C-42951r816784_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|awk '/server\.modules/,/\)/'|grep mod_accesslog Expected result: "mod_accesslog", If the output does not match the expected result, this is a finding.

Fix: F-42910r679263_fix

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Add the following value in the "server.modules" section: mod_accesslog The result should be similar to the following: server.modules = ( "mod_access", "mod_accesslog", "mod_proxy", "mod_cgi", "mod_rewrite", "mod_magnet", "mod_setenv", # 7 )

b
VAMI must generate log records for system startup and shutdown.
AU-12 - Medium - CCI-000169 - V-239719 - SV-239719r879559_rule
RMF Control
AU-12
Severity
M
CCI
CCI-000169
Version
VCLD-67-000005
Vuln IDs
  • V-239719
Rule IDs
  • SV-239719r879559_rule
Logging must be started as soon as possible when a service starts and when a service is stopped. Many forms of suspicious actions can be detected by analyzing logs for unexpected service starts and stops. Also, by starting to log immediately after a service starts, it becomes more difficult for suspicious activity to go unlogged.
Checks: C-42952r816786_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|grep "server.errorlog" Expected result: server.errorlog = "/opt/vmware/var/log/lighttpd/error.log" If the output does not match the expected result, this is a finding.

Fix: F-42911r679266_fix

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Add or reconfigure the following value: server.errorlog = "/opt/vmware/var/log/lighttpd/error.log"

b
VAMI must produce log records containing sufficient information to establish what type of events occurred.
AU-3 - Medium - CCI-000130 - V-239720 - SV-239720r879563_rule
RMF Control
AU-3
Severity
M
CCI
CCI-000130
Version
VCLD-67-000006
Vuln IDs
  • V-239720
Rule IDs
  • SV-239720r879563_rule
After a security incident has occurred, investigators will often review log files to determine what happened. Understanding what type of event occurred is critical for investigation of a suspicious event. Satisfies: SRG-APP-000095-WSR-000056, SRG-APP-000096-WSR-000057, SRG-APP-000097-WSR-000058, SRG-APP-000098-WSR-000059, SRG-APP-000099-WSR-000061, SRG-APP-000100-WSR-000064, SRG-APP-000374-WSR-000172, SRG-APP-000375-WSR-000171
Checks: C-42953r816788_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # grep "^accesslog.format" /opt/vmware/etc/lighttpd/lighttpd.conf The default commented, accesslog format is acceptable for this requirement. No output should be returned. If the command returns any output, this is a finding.

Fix: F-42912r679269_fix

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Comment any existing accesslog.format lines by adding a "#" at the beginning of the line.

b
VAMI log files must only be accessible by privileged users.
AU-9 - Medium - CCI-000162 - V-239721 - SV-239721r879576_rule
RMF Control
AU-9
Severity
M
CCI
CCI-000162
Version
VCLD-67-000011
Vuln IDs
  • V-239721
Rule IDs
  • SV-239721r879576_rule
Log data is essential in the investigation of events. If log data were to become compromised, competent forensic analysis and discovery of the true source of potentially malicious system activity would be difficult, if not impossible, to achieve. In addition, access to log records provides information an attacker could potentially use to their advantage since each event record might contain communication ports, protocols, services, trust relationships, user names, etc. Satisfies: SRG-APP-000118-WSR-000068, SRG-APP-000119-WSR-000069, SRG-APP-000120-WSR-000070
Checks: C-42954r816790_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # stat -c "%n has %a permissions and is owned by %U:%G" /opt/vmware/var/log/lighttpd/*.log Expected result: /opt/vmware/var/log/lighttpd/access.log has 640 permissions and is owned by root:root /opt/vmware/var/log/lighttpd/error.log has 640 permissions and is owned by root:root If the output does not match the expected result, this is a finding.

Fix: F-42913r679272_fix

At the command prompt, enter the following command: # chown root:root /opt/vmware/var/log/lighttpd/*.log # chmod 640 /opt/vmware/var/log/lighttpd/*.log

b
Rsyslog must be configured to monitor VAMI logs.
AU-9 - Medium - CCI-001348 - V-239722 - SV-239722r879582_rule
RMF Control
AU-9
Severity
M
CCI
CCI-001348
Version
VCLD-67-000014
Vuln IDs
  • V-239722
Rule IDs
  • SV-239722r879582_rule
For performance reasons, rsyslog file monitoring is preferred over configuring VAMI to send events to a syslog facility. Without ensuring that logs are created, that rsyslog configs are created, and that those configs are loaded, the log file monitoring and shipping will not be effective. Satisfies: SRG-APP-000125-WSR-000071, SRG-APP-000358-WSR-000063, SRG-APP-000358-WSR-000163
Checks: C-42955r816792_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # grep -v "^#" /etc/vmware-syslog/stig-services-vami.conf Expected result: input(type="imfile" File="/opt/vmware/var/log/lighttpd/access.log" Tag="vami-access" Severity="info" Facility="local0") If the file does not exist, this is a finding. If the output of the command does not match the expected result above, this is a finding.

Fix: F-42914r679275_fix

Navigate to and open /etc/vmware-syslog/stig-services-vami.conf. Create the file if it does not exist. Set the contents of the file as follows: input(type="imfile" File="/opt/vmware/var/log/lighttpd/access.log" Tag="vami-access" Severity="info" Facility="local0")

b
VAMI server binaries and libraries must be verified for their integrity.
CM-5 - Medium - CCI-001749 - V-239723 - SV-239723r879584_rule
RMF Control
CM-5
Severity
M
CCI
CCI-001749
Version
VCLD-67-000015
Vuln IDs
  • V-239723
Rule IDs
  • SV-239723r879584_rule
Being able to verify that a patch, upgrade, certificate, etc., being added to the web server is unchanged from the producer of the file is essential for file validation and non-repudiation of the information. VMware delivers product updates and patches regularly. When VAMI is updated, the signed packages will also be updated. These packages can be used to verify that VAMI has not been inappropriately modified since it was installed.
Checks: C-42956r816794_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # rpm -qa|grep lighttpd|xargs rpm -V|grep -vE "lighttpd.conf|vami-lighttp.*\.service" If the command returns any output, this is a finding.

Fix: F-42915r679278_fix

If the VAMI binaries have been modified from the default state when deployed as part of the VCSA, the system must be wiped and redeployed or restored from backup. VMware does not recommend or support recovering from such a state by reinstalling RPMs or similar efforts.

b
VAMI must only load allowed server modules.
CM-7 - Medium - CCI-000381 - V-239724 - SV-239724r879587_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
VCLD-67-000016
Vuln IDs
  • V-239724
Rule IDs
  • SV-239724r879587_rule
A web server can provide many features, services, and processes. Some of these may be deemed unnecessary or too unsecure to run on a production DoD system. VAMI can be configured to load any number of external modules, but only a specific few are provided and supported by VMware. Additional, unexpected modules must be removed.
Checks: C-42957r816796_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|awk '/server\.modules/,/\)/' Expected result: server.modules = ( "mod_access", "mod_accesslog", "mod_proxy", "mod_cgi", "mod_rewrite", "mod_magnet", "mod_setenv", # 7 ) If the output does not match the expected result, this is a finding.

Fix: F-42916r679281_fix

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Configure the "server.modules" section to the following: server.modules = ( "mod_access", "mod_accesslog", "mod_proxy", "mod_cgi", "mod_rewrite", ) server.modules += ( "mod_magnet" )

b
VAMI must have Multipurpose Internet Mail Extensions (MIME) that invoke OS shell programs disabled.
CM-7 - Medium - CCI-000381 - V-239725 - SV-239725r879587_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
VCLD-67-000017
Vuln IDs
  • V-239725
Rule IDs
  • SV-239725r879587_rule
Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or the user could use the function in an unintentional manner. A MIME tells the web server what type of program various file types and extensions are and what external utilities or programs are needed to execute the file type. There is no reason for VAMI to have MIME types configured for shell scripts.
Checks: C-42958r816798_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|awk '/mimetype\.assign/,/\)/'|grep -E "\.sh|\.csh" If the command returns any value, this is a finding.

Fix: F-42917r679284_fix

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Remove any lines that reference ".sh" or ".csh" from the "mimetype.assign" section.

b
VAMI must explicitly disable Multipurpose Internet Mail Extensions (MIME) mappings based on "Content-Type".
CM-7 - Medium - CCI-000381 - V-239726 - SV-239726r879587_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
VCLD-67-000018
Vuln IDs
  • V-239726
Rule IDs
  • SV-239726r879587_rule
Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or the user could use the function in an unintentional manner. A MIME tells the web server what type of program various file types and extensions are and what external utilities or programs are needed to execute the file type. A limited number of MIME types must be configured manually and automatic mapping must be disabled.
Checks: C-42959r816800_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|grep "mimetype.use-xattr" Expected result: mimetype.use-xattr = "disable" If the output does not match the expected result, this is a finding.

Fix: F-42918r679287_fix

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Add or reconfigure the following value: mimetype.use-xattr = "disable"

b
VAMI must remove all mappings to unused scripts.
CM-7 - Medium - CCI-000381 - V-239727 - SV-239727r879587_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
VCLD-67-000019
Vuln IDs
  • V-239727
Rule IDs
  • SV-239727r879587_rule
Scripts allow server-side processing on behalf of the hosted application user or as processes needed in the implementation of hosted applications. Removing scripts not needed for application operation or deemed vulnerable helps to secure the web server. To ensure scripts are not added to the web server and run maliciously, script mappings that are not needed or used by the web server for hosted application operation must be removed.
Checks: C-42960r816802_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|awk '/cgi\.assign/,/\)/' Expected result: cgi.assign = ( ".pl" => "/usr/bin/perl", ".cgi" => "/usr/bin/perl", ".rb" => "/usr/bin/ruby", ".erb" => "/usr/bin/eruby", ".py" => "/usr/bin/python", # 5 ) If the output does not match the expected result, this is a finding.

Fix: F-42919r679290_fix

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Configure the "cgi.assign" section to the following: cgi.assign = ( ".pl" => "/usr/bin/perl", ".cgi" => "/usr/bin/perl", ".rb" => "/usr/bin/ruby", ".erb" => "/usr/bin/eruby", ".py" => "/usr/bin/python", # 5 )

b
VAMI must have resource mappings set to disable the serving of certain file types.
CM-7 - Medium - CCI-000381 - V-239728 - SV-239728r879587_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
VCLD-67-000020
Vuln IDs
  • V-239728
Rule IDs
  • SV-239728r879587_rule
Resource mapping is the process of tying a particular file type to a process in the web server that can serve that type of file to a requesting client and identify which file types are not to be delivered to a client. By not specifying which files can and cannot be served to a user, VAMI could potentially deliver sensitive files.
Checks: C-42961r816804_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|grep "url.access-deny" Expected result: url.access-deny = ("~", ".inc") If the output does not match the expected result, this is a finding.

Fix: F-42920r679293_fix

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Add or reconfigure the following value: url.access-deny = ( "~", ".inc" )

b
VAMI must not have the Web Distributed Authoring (WebDAV) servlet installed.
CM-7 - Medium - CCI-000381 - V-239729 - SV-239729r879587_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
VCLD-67-000021
Vuln IDs
  • V-239729
Rule IDs
  • SV-239729r879587_rule
A web server can be installed with functionality that, by its nature, is not secure. WebDAV is an extension to the HTTP protocol that, when developed, was meant to allow users to create, change, and move documents on a server, typically a web server or web share. Allowing this functionality, development, and deployment is much easier for web authors. WebDAV is not widely used and has serious security concerns because it may allow clients to modify unauthorized files on the web server.
Checks: C-42962r816806_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|awk '/server\.modules/,/\)/'|grep mod_webdav If any value is returned, this is a finding.

Fix: F-42921r679296_fix

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Delete or comment out the "mod_webdav" line. The line may be in an included config and not in the parent config.

b
VAMI must prevent hosted applications from exhausting system resources.
CM-7 - Medium - CCI-000381 - V-239730 - SV-239730r879587_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
VCLD-67-000022
Vuln IDs
  • V-239730
Rule IDs
  • SV-239730r879587_rule
Most of the attention to denial-of-service (DoS) attacks focuses on ensuring that systems and applications are not victims of these attacks. However, these systems and applications must also be secured against use to launch such an attack against others. A variety of technologies exist to limit or, in some cases, eliminate the effects of DoS attacks. Limiting system resources that are allocated to any user to a bare minimum may also reduce the ability of users to launch some DoS attacks. One DoS mitigation is to prevent VAMI from keeping idle connections open for too long.
Checks: C-42963r816808_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|grep "server.max-keep-alive-idle" Expected result: server.max-keep-alive-idle = 30 If the output does not match the expected result, this is a finding.

Fix: F-42922r679299_fix

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf file. Add or reconfigure the following value: server.max-keep-alive-idle = 30

b
VAMI must not have any symbolic links in the web content directory tree.
CM-7 - Medium - CCI-000381 - V-239731 - SV-239731r879587_rule
RMF Control
CM-7
Severity
M
CCI
CCI-000381
Version
VCLD-67-000023
Vuln IDs
  • V-239731
Rule IDs
  • SV-239731r879587_rule
A web server is designed to deliver content and execute scripts or applications on the request of a client or user. Containing user requests to files in the directory tree of the hosted web application and limiting the execution of scripts and applications guarantees that the user is not accessing information protected outside the application's realm. By checking that no symbolic links exist in the document root, the web server is protected from users jumping outside the hosted application directory tree and gaining access to the other directories, including the system root.
Checks: C-42964r816810_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # find /opt/vmware/share/htdocs -type l If any files are listed, this is a finding.

Fix: F-42923r679302_fix

At the command prompt, enter the following command: # unlink <file_name> Note: Replace <file_name> for the name of any files that were returned. Repeat the command for each file that was listed.

b
VAMI must protect the keystore from unauthorized access.
IA-5 - Medium - CCI-000186 - V-239732 - SV-239732r879613_rule
RMF Control
IA-5
Severity
M
CCI
CCI-000186
Version
VCLD-67-000025
Vuln IDs
  • V-239732
Rule IDs
  • SV-239732r879613_rule
The web server's private key is used to prove the identity of the server to clients and securely exchange the shared secret key used to encrypt communications between the web server and clients. By gaining access to the private key, an attacker can pretend to be an authorized server and decrypt the SSL traffic between a client and the web server.
Checks: C-42965r816812_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # stat -c "%n has %a permissions and is owned by %U:%G" /etc/applmgmt/appliance/server.pem Expected result: /etc/applmgmt/appliance/server.pem has 600 permissions and is owned by root:root If the output does not match the expected result, this is a finding.

Fix: F-42924r679305_fix

At the command prompt, execute the following commands: # chown root:root /etc/applmgmt/appliance/server.pem # chmod 600 /etc/applmgmt/appliance/server.pem

b
VAMI must restrict access to the web root.
SC-2 - Medium - CCI-001082 - V-239733 - SV-239733r879631_rule
RMF Control
SC-2
Severity
M
CCI
CCI-001082
Version
VCLD-67-000026
Vuln IDs
  • V-239733
Rule IDs
  • SV-239733r879631_rule
As a rule, accounts on a web server are to be kept to a minimum, and those accounts are then restricted as to what they are allowed to access. The web root of the VAMI Lighttpd installation contains the content that is served up to the end user. This content must have the minimum necessary permissions and proper ownership to help protect against unprivileged modification of the content.
Checks: C-42966r816814_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # find /opt/vmware/share/htdocs/ -xdev -type d -a '(' -not -perm 0755 -o -not -user root -o -not -group root ')' -exec ls -ld {} \; If any files are returned, this is a finding.

Fix: F-42925r679308_fix

At the command prompt, execute the following commands: # chmod 0755 <directory> # chown root:root <directory> Note: Substitute <directory> with each directory returned from the check.

b
VAMI must protect against or limit the effects of HTTP types of denial-of-service (DoS) attacks.
SC-5 - Medium - CCI-001094 - V-239734 - SV-239734r879650_rule
RMF Control
SC-5
Severity
M
CCI
CCI-001094
Version
VCLD-67-000027
Vuln IDs
  • V-239734
Rule IDs
  • SV-239734r879650_rule
In UNIX and related computer operating systems, a file descriptor is an indicator used to access a file or other input/output resource, such as a pipe or network connection. File descriptors index into a per-process file descriptor table maintained by the kernel, which in turn indexes into a system-wide table of files opened by all processes, called the file table. As a single-threaded server, Lighttpd must be limited in the number of file descriptors that can be allocated. This will prevent Lighttpd from being used in a form of DoS attack against the operating system.
Checks: C-42967r816816_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|grep "server.max-fds" Expected result: server.max-fds = 2048 If the output does not match the expected result, this is a finding.

Fix: F-42926r679311_fix

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Add or reconfigure the following value: server.max-fds = 2048

b
VAMI must set the encoding for all text mime types to UTF-8.
SI-10 - Medium - CCI-001310 - V-239735 - SV-239735r879652_rule
RMF Control
SI-10
Severity
M
CCI
CCI-001310
Version
VCLD-67-000028
Vuln IDs
  • V-239735
Rule IDs
  • SV-239735r879652_rule
Invalid user input occurs when a user inserts data or characters into a hosted application's data entry field and the hosted application is unprepared to process that data. This results in unanticipated application behavior, potentially leading to an application compromise. Invalid user input is one of the primary methods employed when attempting to compromise an application. An attacker can also enter Unicode into hosted applications in an effort to break out of the document home or root home directory or to bypass security checks.
Checks: C-42968r816818_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|awk '/mimetype\.assign/,/\)/'|grep "text/"|grep -v "charset=utf-8" If the command returns any value, this is a finding.

Fix: F-42927r679314_fix

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Navigate to the "mimetype.assign" block. Replace all the mappings whose assigned type is "text/*" with mappings for UTF-8 encoding, as follows: ".css" => "text/css; charset=utf-8", ".html" => "text/html; charset=utf-8", ".htm" => "text/html; charset=utf-8", ".js" => "text/javascript; charset=utf-8", ".asc" => "text/plain; charset=utf-8", ".c" => "text/plain; charset=utf-8", ".cpp" => "text/plain; charset=utf-8", ".log" => "text/plain; charset=utf-8", ".conf" => "text/plain; charset=utf-8", ".text" => "text/plain; charset=utf-8", ".txt" => "text/plain; charset=utf-8", ".spec" => "text/plain; charset=utf-8", ".dtd" => "text/xml; charset=utf-8", ".xml" => "text/xml; charset=utf-8",

b
VAMI must disable directory browsing.
SI-11 - Medium - CCI-001312 - V-239736 - SV-239736r879655_rule
RMF Control
SI-11
Severity
M
CCI
CCI-001312
Version
VCLD-67-000029
Vuln IDs
  • V-239736
Rule IDs
  • SV-239736r879655_rule
The goal is to completely control the web user's experience in navigating any portion of the web document root directories. Ensuring all web content directories have at least the equivalent of an "index.html" file is a significant factor to accomplish this end. Enumeration techniques, such as URL parameter manipulation, rely on being able to obtain information about the web server's directory structure by locating directories without default pages. In this scenario, the web server will display to the user a listing of the files in the directory being accessed. By having a default hosted application web page, the anonymous web user will not obtain directory browsing information or an error message that reveals the server type and version.
Checks: C-42969r816820_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|grep "dir-listing.activate" Expected result: dir-listing.activate = "disable" If the output does not match the expected result, this is a finding.

Fix: F-42928r679317_fix

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Add or reconfigure the following value: dir-listing.activate = "disable"

b
VAMI must not be configured to use "mod_status".
SI-11 - Medium - CCI-001312 - V-239737 - SV-239737r879655_rule
RMF Control
SI-11
Severity
M
CCI
CCI-001312
Version
VCLD-67-000030
Vuln IDs
  • V-239737
Rule IDs
  • SV-239737r879655_rule
Any application providing too much information in error logs and in administrative messages to the screen risks compromising the data and security of the application and system. VAMI must only generate error messages that provide information necessary for corrective actions without revealing sensitive or potentially harmful information in error logs and administrative messages. The "mod_status" module generates the status overview of the webserver. The information covers: - uptime - average throughput - current throughput - active connections and their state While this information is useful on a development system, production systems must not have "mod_status" enabled.
Checks: C-42970r816822_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|awk '/server\.modules/,/\)/'|grep mod_status If any value is returned, this is a finding.

Fix: F-42929r679320_fix

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Remove the line containing "mod_status". The line may be in an included config and not in the parent config itself.

b
VAMI must have debug logging disabled.
SI-11 - Medium - CCI-001312 - V-239738 - SV-239738r879655_rule
RMF Control
SI-11
Severity
M
CCI
CCI-001312
Version
VCLD-67-000031
Vuln IDs
  • V-239738
Rule IDs
  • SV-239738r879655_rule
Information needed by an attacker to begin looking for possible vulnerabilities in a web server includes any information about the web server and plug-ins or modules being used. When debugging or trace information is enabled in a production web server, information about the web server, such as web server type, version, patches installed, plug-ins and modules installed, type of code being used by the hosted application, and any backends being used for data storage, may be displayed. Since this information may be placed in logs and general messages during normal operation of the web server, an attacker does not need to cause an error condition to gain this information.
Checks: C-42971r816824_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|grep "debug.log-request-handling" Expected result: debug.log-request-handling = "disable" If the output does not match the expected result, this is a finding.

Fix: F-42930r679323_fix

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Add or reconfigure the following value: debug.log-request-handling = "disable"

b
VAMI configuration files must be protected from unauthorized access.
CM-5 - Medium - CCI-001813 - V-239739 - SV-239739r879753_rule
RMF Control
CM-5
Severity
M
CCI
CCI-001813
Version
VCLD-67-000032
Vuln IDs
  • V-239739
Rule IDs
  • SV-239739r879753_rule
Accounts on the VAMI server are to be kept to a minimum. Only administrators, web managers, developers, auditors, and web authors require accounts on the machine hosting the Lighttpd server. The resources to which these accounts have access must also be closely monitored and controlled. Only the system administrator needs access to all of the system's capabilities, while the web administrator and associated staff require access and control of the web content and the Lighttpd server configuration files.
Checks: C-42972r816826_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # stat -c "%n permissions are %a and ownership is %U:%G" /opt/vmware/etc/lighttpd/lighttpd.conf /etc/applmgmt/appliance/lighttpd.conf Expected result: /opt/vmware/etc/lighttpd/lighttpd.conf permissions are 644 and ownership is root:root /etc/applmgmt/appliance/lighttpd.conf permissions are 644 and ownership is root:root If the output does not match the expected result, this is a finding.

Fix: F-42931r679326_fix

At the command prompt, enter the following command: # chmod 644 <file> # chown root:root <file> Note: Replace <file> with every file returned from the command in the check.

b
VAMI must be protected from being stopped by a non-privileged user.
SC-5 - Medium - CCI-002385 - V-239740 - SV-239740r879806_rule
RMF Control
SC-5
Severity
M
CCI
CCI-002385
Version
VCLD-67-000033
Vuln IDs
  • V-239740
Rule IDs
  • SV-239740r879806_rule
An attacker has at least two reasons to stop a web server. The first is to cause a denial of service, and the second is to put in place changes the attacker made to the web server configuration. Therefore, only administrators should ever be able to stop VAMI. The VAMI is configured out of the box to be owned by root. This configuration must be verified and maintained.
Checks: C-42973r816828_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # ps -f -U root | awk '$0 ~ /vami-lighttpd/ &amp;&amp; $0 !~ /awk/ {print $1}' Expected result: root If the output does not match the expected result, this is a finding.

Fix: F-42932r679329_fix

Navigate to and open /usr/lib/systemd/system/vami-lighttp.service in a text editor. Under the "[Service]" section, remove the line that beings with "User=". At the command prompt, execute the following command: # service vami-lighttp restart

c
VAMI must implement TLS1.2 exclusively.
SC-8 - High - CCI-002418 - V-239741 - SV-239741r879810_rule
RMF Control
SC-8
Severity
H
CCI
CCI-002418
Version
VCLD-67-000034
Vuln IDs
  • V-239741
Rule IDs
  • SV-239741r879810_rule
Transport Layer Security (TLS) is a required transmission protocol for a web server hosting controlled information. The use of TLS provides confidentiality of data in transit between the web server and client. FIPS 140-2 approved TLS versions must be enabled, and non-FIPS-approved SSL versions must be disabled. VAMI comes configured to use only TLS 1.2. This configuration must be verified and maintained.
Checks: C-42974r816830_chk

Note: The below command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|grep "ssl.use" Expected result: ssl.use-tlsv12 = "enable" ssl.use-sslv2 = "disable" ssl.use-sslv3 = "disable" ssl.use-tlsv10 = "disable" ssl.use-tlsv11 = "disable" If the output does not match the expected result, this is a finding.

Fix: F-42933r679332_fix

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Replace any and all "ssl.use-*" lines with following: ssl.use-tlsv12 = "enable" ssl.use-sslv2 = "disable" ssl.use-sslv3 = "disable" ssl.use-tlsv10 = "disable" ssl.use-tlsv11 = "disable"

c
The version of VAMI-lighttpd running on the system must be a supported version.
SI-2 - High - CCI-002605 - V-257285 - SV-257285r919286_rule
RMF Control
SI-2
Severity
H
CCI
CCI-002605
Version
VCLD-67-000999
Vuln IDs
  • V-257285
Rule IDs
  • SV-257285r919286_rule
Security flaws with software applications are discovered daily. Vendors are constantly updating and patching their products to address newly discovered security vulnerabilities. Organizations (including any contractor to the organization) are required to promptly install security-relevant software updates (e.g., patches, service packs, and hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling must also be addressed expeditiously. Organization-defined time periods for updating security-relevant software may vary based on a variety of factors including, for example, the security category of the information system or the criticality of the update (i.e., severity of the vulnerability related to the discovered flaw). This requirement will apply to software patch management solutions that are used to install patches across the enclave and to applications that are not part of that patch management solution. For example, many browsers today provide the capability to install their own patch software. Patch criticality, as well as system criticality, will vary. Therefore, the tactical situations regarding the patch management process will also vary. This means the time period used must be a configurable parameter. Time frames for application of security-relevant software updates may be dependent upon the Information Assurance Vulnerability Management (IAVM) process. The application will be configured to check for and install security-relevant software updates within an identified time period from the availability of the update. The specific time period will be defined by an authoritative source (e.g., IAVM, CTOs, DTMs, and STIGs).
Checks: C-60970r918895_chk

VAMI-lighttpd 6.7 is no longer supported by the vendor. If the system is running VAMI-lighttpd 6.7, this is a finding.

Fix: F-53958r798705_fix

Upgrade to a supported version.