Cyber Trackr - Free Compliance Library
Cyber Trackr
The Free Compliance Library

VMware vSphere 7.0 VAMI Security Technical Implementation Guide

  • Version/Release: V1R2
  • Published: 2023-06-15
  • Released: 2023-07-26
  • Expand All:
  • Severity:
  • Sort:
Compare

Select any two versions of this STIG to compare the individual requirements

View

Select any old version/release of this STIG to view the previous requirements

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.
b
VAMI must limit the number of simultaneous requests.
AC-10 - Medium - CCI-000054 - V-256645 - SV-256645r888457_rule
RMF Control
AC-10
Severity
Medium
CCI
CCI-000054
Version
VCLD-70-000001
Vuln IDs
  • V-256645
Rule IDs
  • SV-256645r888457_rule
Denial of service (DoS) is one threat against web servers. Many DoS attacks attempt to consume web server resources in such a way that no more resources are available to satisfy legitimate requests. Mitigation against these threats is to take steps to limit the number of resources that can be consumed in certain ways. VAMI provides the "maxConnections" attribute of the to limit the number of concurrent Transmission Control Protocol (TCP) connections. This comes preconfigured with a tested, supported value that must be verified and maintained.
Checks: C-60320r888455_chk

At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2>/dev/null |grep "server.max-connections"|sed -e 's/^[ ]*//' Expected result: server.max-connections = 1024 If the output does not match the expected result, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Fix: F-60263r888456_fix

Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf Add or reconfigure the following value: server.max-connections = 1024 Restart the service with the following command: # vmon-cli --restart applmgmt

c
VAMI must be configured with FIPS 140-2 compliant ciphers for HTTPS connections.
AC-17 - High - CCI-000068 - V-256646 - SV-256646r888460_rule
RMF Control
AC-17
Severity
High
CCI
CCI-000068
Version
VCLD-70-000002
Vuln IDs
  • V-256646
Rule IDs
  • SV-256646r888460_rule
Encryption of data in flight is an essential element of protecting information confidentiality. If a web server uses weak or outdated encryption algorithms, the server's communications could be compromised. The U.S. Federal Information Processing Standards (FIPS) publication 140-2, Security Requirements for Cryptographic Modules (FIPS 140-2), identifies 11 areas for a cryptographic module used inside a security system that protects information. FIPS 140-2 approved ciphers provide the maximum level of encryption possible for a private web server. VAMI is compiled to use VMware's FIPS-validated OpenSSL module and cannot be configured otherwise. Ciphers may still be specified in order of preference, but no non-FIPS approved ciphers will be implemented. Satisfies: SRG-APP-000014-WSR-000006, SRG-APP-000416-WSR-000118, SRG-APP-000439-WSR-000188
Checks: C-60321r888458_chk

At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2>/dev/null|grep "ssl.cipher-list"|sed -e 's/^[ ]*//' Expected result: ssl.cipher-list = "!aNULL:kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH+AES:RSA+AES" If the output does not match the expected result, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Fix: F-60264r888459_fix

Navigate to and open: /etc/applmgmt/appliance/lighttpd.conf Add or reconfigure the following value: ssl.cipher-list = "!aNULL:kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH+AES:ECDH+AES:RSA+AES" Restart the service with the following command: # vmon-cli --restart applmgmt

b
VAMI must use cryptography to protect the integrity of remote sessions.
IA-5 - Medium - CCI-000197 - V-256647 - SV-256647r888463_rule
RMF Control
IA-5
Severity
Medium
CCI
CCI-000197
Version
VCLD-70-000003
Vuln IDs
  • V-256647
Rule IDs
  • SV-256647r888463_rule
Data exchanged between the user and the web server can range from static display data to credentials used to log in the hosted application. Even when data appears to be static, the nondisplayed logic in a web page may expose business logic or trusted system relationships. The integrity of all the data being exchanged between the user and web server must always be trusted. To protect the integrity and trust, encryption methods should be used to protect the complete communication session. To protect the integrity and confidentiality of the remote sessions, VAMI uses Secure Sockets Layer (SSL)/Transport Layer Security (TLS). Satisfies: SRG-APP-000015-WSR-000014, SRG-APP-000172-WSR-000104, SRG-APP-000315-WSR-000003, SRG-APP-000439-WSR-000151, SRG-APP-000439-WSR-000152
Checks: C-60322r888461_chk

At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2>/dev/null|grep "ssl.engine"|sed -e 's/^[ ]*//' Expected result: ssl.engine = "enable" If the output does not match the expected result, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Fix: F-60265r888462_fix

Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf Add or reconfigure the following value: ssl.engine = "enable" Restart the service with the following command: # vmon-cli --restart applmgmt

b
VAMI must be configured to monitor remote access.
AC-17 - Medium - CCI-000067 - V-256648 - SV-256648r888466_rule
RMF Control
AC-17
Severity
Medium
CCI
CCI-000067
Version
VCLD-70-000004
Vuln IDs
  • V-256648
Rule IDs
  • SV-256648r888466_rule
Remote access can be exploited by an attacker to compromise the server. By recording all remote access activities, it will be possible to determine the attacker's location, intent, and degree of success. VAMI uses the "mod_accesslog" module to log information relating to remote requests. These logs can then be piped to external monitoring systems. Satisfies: SRG-APP-000016-WSR-000005, SRG-APP-000093-WSR-000053
Checks: C-60323r888464_chk

At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2>/dev/null|awk '/server\.modules/,/\)/'|grep mod_accesslog|sed -e 's/^[ ]*//' Expected result: "mod_accesslog", If the output does not match the expected result, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Fix: F-60266r888465_fix

Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf Add the following value in the "server.modules" section: mod_accesslog The result should be similar to the following: server.modules = ( "mod_access", "mod_accesslog", "mod_proxy", "mod_cgi", "mod_rewrite", "mod_magnet", "mod_setenv", ) Restart the service with the following command: # vmon-cli --restart applmgmt

b
VAMI must generate log records for system startup and shutdown.
AU-12 - Medium - CCI-000169 - V-256649 - SV-256649r888469_rule
RMF Control
AU-12
Severity
Medium
CCI
CCI-000169
Version
VCLD-70-000005
Vuln IDs
  • V-256649
Rule IDs
  • SV-256649r888469_rule
Logging must be started as soon as possible when a service starts and when a service is stopped. Many forms of suspicious actions can be detected by analyzing logs for unexpected service starts and stops. Also, by starting to log immediately after a service starts, it becomes more difficult for suspicious activity to go unlogged.
Checks: C-60324r888467_chk

At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2>/dev/null|grep "server.errorlog"|sed -e 's/^[ ]*//' Expected result: server.errorlog = "/opt/vmware/var/log/lighttpd/error.log" If the output does not match the expected result, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Fix: F-60267r888468_fix

Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf Add or reconfigure the following value: server.errorlog = "/opt/vmware/var/log/lighttpd/error.log" Restart the service with the following command: # vmon-cli --restart applmgmt

b
VAMI must produce log records containing sufficient information to establish what type of events occurred.
AU-3 - Medium - CCI-000130 - V-256650 - SV-256650r888472_rule
RMF Control
AU-3
Severity
Medium
CCI
CCI-000130
Version
VCLD-70-000006
Vuln IDs
  • V-256650
Rule IDs
  • SV-256650r888472_rule
After a security incident has occurred, investigators will often review log files to determine what happened. Understanding what type of event occurred is critical for investigation of a suspicious event. Satisfies: SRG-APP-000095-WSR-000056, SRG-APP-000096-WSR-000057, SRG-APP-000097-WSR-000058, SRG-APP-000098-WSR-000059, SRG-APP-000099-WSR-000061, SRG-APP-000100-WSR-000064, SRG-APP-000374-WSR-000172, SRG-APP-000375-WSR-000171
Checks: C-60325r888470_chk

At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2>/dev/null|grep "accesslog.format"|sed -e 's/^[ ]*//' The default commented, "accesslog" format is acceptable for this requirement. No output should be returned. If the command returns any output, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Fix: F-60268r888471_fix

Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf Comment any existing "accesslog.format" lines by adding a "#" at the beginning of the line. Restart the service with the following command: # vmon-cli --restart applmgmt

b
VAMI log files must only be accessible by privileged users.
AU-9 - Medium - CCI-000162 - V-256651 - SV-256651r918984_rule
RMF Control
AU-9
Severity
Medium
CCI
CCI-000162
Version
VCLD-70-000007
Vuln IDs
  • V-256651
Rule IDs
  • SV-256651r918984_rule
Log data is essential in the investigation of events. If log data were to become compromised, competent forensic analysis and discovery of the true source of potentially malicious system activity would be difficult, if not impossible, to achieve. In addition, access to log records provides information an attacker could use to their advantage because each event record might contain communication ports, protocols, services, trust relationships, user names, etc. Satisfies: SRG-APP-000118-WSR-000068, SRG-APP-000119-WSR-000069, SRG-APP-000120-WSR-000070
Checks: C-60326r918982_chk

At the command prompt, run the following command: # find /opt/vmware/var/log/lighttpd/ -xdev -type f -a '(' -perm -o+w -o -not -user root -o -not -group root ')' -exec ls -ld {} \; If any files are returned, this is a finding.

Fix: F-60269r918983_fix

At the command prompt, run the following commands: # chmod o-w <file> # chown root:root <file> Note: Substitute <file> with the listed file.

b
The rsyslog must be configured to monitor VAMI logs.
AU-9 - Medium - CCI-001348 - V-256652 - SV-256652r888478_rule
RMF Control
AU-9
Severity
Medium
CCI
CCI-001348
Version
VCLD-70-000008
Vuln IDs
  • V-256652
Rule IDs
  • SV-256652r888478_rule
For performance reasons, rsyslog file monitoring is preferred over configuring VAMI to send events to a syslog facility. Without ensuring that logs are created, rsyslog configs are created, and those configs are loaded, the log file monitoring and shipping will not be effective. VAMI syslog configuration is included by default as part of the VMware-visl-integration package. The shipping state of the configuration file must be verified and maintained. Satisfies: SRG-APP-000125-WSR-000071, SRG-APP-000358-WSR-000063, SRG-APP-000358-WSR-000163
Checks: C-60327r888476_chk

At the command prompt, run the following command: # rpm -V VMware-visl-integration|grep vmware-services-applmgmt.conf If the command returns any output, this is a finding.

Fix: F-60270r888477_fix

Navigate to and open: /etc/vmware-syslog/vmware-services-applmgmt.conf Create the file if it does not exist. Set the contents of the file as follows: #applmgmt.log input(type="imfile" File="/var/log/vmware/applmgmt/applmgmt.log" Tag="applmgmt" Severity="info" Facility="local0") #applmgmt-audit.log input(type="imfile" File="/var/log/vmware/applmgmt-audit/applmgmt-audit.log" Tag="applmgmt-audit" Severity="info" Facility="local0") #applmgmt-backup-restore-audit.log input(type="imfile" File="/var/log/vmware/applmgmt-audit/applmgmt-br-audit.log" Tag="applmgmt-br-audit" Severity="info" Facility="local0") #vami-access.log input(type="imfile" File="/opt/vmware/var/log/lighttpd/access.log" Tag="vami-access" Severity="info" Facility="local0") #vami-error.log input(type="imfile" File="/opt/vmware/var/log/lighttpd/error.log" Tag="vami-error" Severity="info" Facility="local0") #dcui.log input(type="imfile" File="/var/log/vmware/applmgmt/dcui.log" Tag="dcui" Severity="info" Facility="local0") #detwist.log input(type="imfile" File="/var/log/vmware/applmgmt/detwist.log" Tag="detwist" Severity="info" Facility="local0") #firewall-reload.log input(type="imfile" File="/var/log/vmware/applmgmt/firewall-reload.log" Tag="firewall-reload" Severity="info" Facility="local0") #applmgmt_vmonsvc.std* input(type="imfile" File="/var/log/vmware/applmgmt/applmgmt_vmonsvc.std*" Tag="applmgmt_vmonsvc" Severity="info" Facility="local0") #backupSchedulerCron input(type="imfile" File="/var/log/vmware/applmgmt/backupSchedulerCron.log" Tag="backupSchedulerCron" Severity="info" Facility="local0") #progress.log input(type="imfile" File="/var/log/vmware/applmgmt/progress.log" Tag="progress" Severity="info" Facility="local0") #statsmonitor-alarms input(type="imfile" File="/var/log/vmware/applmgmt/statsmonitor-alarms.log" Tag="statsmonitor-alarms" Severity="info" Facility="local0") #StatsMonitor input(type="imfile" File="/var/log/vmware/applmgmt/StatsMonitor.log" Tag="StatsMonitor" Severity="info" Facility="local0") #StatsMonitorStartup.log.std* input(type="imfile" File="/var/log/vmware/applmgmt/StatsMonitorStartup.log.std*" Tag="StatsMonitor-Startup" Severity="info" Facility="local0") #PatchRunner input(type="imfile" File="/var/log/vmware/applmgmt/PatchRunner.log" Tag="PatchRunner" Severity="info" Facility="local0") #update_microservice input(type="imfile" File="/var/log/vmware/applmgmt/update_microservice.log" Tag="update_microservice" Severity="info" Facility="local0") #vami input(type="imfile" File="/var/log/vmware/applmgmt/vami.log" Tag="vami" Severity="info" Facility="local0") #vcdb_pre_patch input(type="imfile" File="/var/log/vmware/applmgmt/vcdb_pre_patch.*" Tag="vcdb_pre_patch" Severity="info" Facility="local0") #dnsmasq.log input(type="imfile" File="/var/log/vmware/dnsmasq.log" Tag="dnsmasq" Severity="info" Facility="local0") #procstate input(type="imfile" File="/var/log/vmware/procstate" Tag="procstate" Severity="info" Facility="local0") #backup.log input(type="imfile" File="/var/log/vmware/applmgmt/backup.log" Tag="applmgmt-backup" Severity="info" Facility="local0") #size.log input(type="imfile" File="/var/log/vmware/applmgmt/size.log" Tag="applmgmt-size" Severity="info" Facility="local0") #restore.log input(type="imfile" File="/var/log/vmware/applmgmt/restore.log" Tag="applmgmt-restore" Severity="info" Facility="local0") #reconciliation.log input(type="imfile" File="/var/log/vmware/applmgmt/reconciliation.log" Tag="applmgmt-reconciliation" Severity="info" Facility="local0") #pnid_change.log input(type="imfile" File="/var/log/vmware/applmgmt/pnid_change.log" Tag="applmgmt-pnid-change" Severity="info" Facility="local0") File="/opt/vmware/var/log/lighttpd/error.log" Tag="vami-error" Severity="info" Facility="local0") input(type="imfile" File="/var/log/vmware/applmgmt/dcui.log" Tag="dcui" Severity="info" Facility="local0") input(type="imfile" File="/var/log/vmware/applmgmt/detwist.log" Tag="detwist" Severity="info" Facility="local0") input(type="imfile" File="/var/log/vmware/applmgmt/firewall-reload.log" Tag="firewall-reload" Severity="info" Facility="local0") input(type="imfile" File="/var/log/vmware/applmgmt/applmgmt_vmonsvc.std*" Tag="applmgmt_vmonsvc" Severity="info" Facility="local0") input(type="imfile" File="/var/log/vmware/applmgmt/backupSchedulerCron.log" Tag="backupSchedulerCron" Severity="info" Facility="local0") input(type="imfile" File="/var/log/vmware/applmgmt/progress.log" Tag="progress" Severity="info" Facility="local0") input(type="imfile" File="/var/log/vmware/applmgmt/statsmoitor-alarms.log" Tag="statsmoitor-alarms" Severity="info" Facility="local0") input(type="imfile" File="/var/log/vmware/applmgmt/StatsMonitor.log" Tag="StatsMonitor" Severity="info" Facility="local0") input(type="imfile" File="/var/log/vmware/applmgmt/StatsMonitorStartup.log.std*" Tag="StatsMonitor-Startup" Severity="info" Facility="local0") input(type="imfile" File="/var/log/vmware/applmgmt/PatchRunner.log" Tag="PatchRunner" Severity="info" Facility="local0") input(type="imfile" File="/var/log/vmware/applmgmt/update_microservice.log" Tag="update_microservice" Severity="info" Facility="local0") input(type="imfile" File="/var/log/vmware/applmgmt/vami.log" Tag="vami" Severity="info" Facility="local0") input(type="imfile" File="/var/log/vmware/applmgmt/vcdb_pre_patch.*" Tag="vcdb_pre_patch" Severity="info" Facility="local0") input(type="imfile" File="/var/log/vmware/dnsmasq.log" Tag="dnsmasq" Severity="info" Facility="local0") input(type="imfile" File="/var/log/vmware/procstate" Tag="procstate" Severity="info" Facility="local0") input(type="imfile" File="/var/log/vmware/applmgmt/backup.log" Tag="applmgmt-backup" Severity="info" Facility="local0") input(type="imfile" File="/var/log/vmware/applmgmt/size.log" Tag="applmgmt-size" Severity="info" Facility="local0") input(type="imfile" File="/var/log/vmware/applmgmt/restore.log" Tag="applmgmt-restore" Severity="info" Facility="local0") input(type="imfile" File="/var/log/vmware/applmgmt/reconciliation.log" Tag="applmgmt-reconciliation" Severity="info" Facility="local0") input(type="imfile" File="/var/log/vmware/applmgmt/pnid_change.log" Tag="applmgmt-pnid-change" Severity="info" Facility="local0")

b
VAMI server binaries and libraries must be verified for their integrity.
SC-2 - Medium - CCI-001082 - V-256653 - SV-256653r888481_rule
RMF Control
SC-2
Severity
Medium
CCI
CCI-001082
Version
VCLD-70-000009
Vuln IDs
  • V-256653
Rule IDs
  • SV-256653r888481_rule
Being able to verify that a patch, upgrade, certificate, etc., being added to the web server is unchanged from the producer of the file is essential for file validation and nonrepudiation of the information. VMware delivers product updates and patches regularly. When VAMI is updated, the signed packages will also be updated. These packages can be used to verify that VAMI has not been inappropriately modified since it was installed. The file "lighttpd.conf" and "vami-lighttp.service" are intentionally modified on first boot and thus are excluded from the check. Satisfies: SRG-APP-000131-WSR-000051, SRG-APP-000211-WSR-000030, SRG-APP-000380-WSR-000072
Checks: C-60328r888479_chk

At the command prompt, run the following command: # rpm -qa|grep lighttpd|xargs rpm -V|grep -v -E "lighttpd.conf|vami-lighttp.service" If the command returns any output, this is a finding.

Fix: F-60271r888480_fix

If the VAMI binaries have been modified from the default state when deployed as part of the vCenter Server Appliance (VCSA), the system must be wiped and redeployed or restored from backup. VMware does not recommend or support recovering from such a state by reinstalling RPMs or similar efforts.

b
VAMI must only load allowed server modules.
CM-7 - Medium - CCI-000381 - V-256654 - SV-256654r888484_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
VCLD-70-000010
Vuln IDs
  • V-256654
Rule IDs
  • SV-256654r888484_rule
A web server can provide many features, services, and processes. Some of these may be deemed unnecessary or too unsecure to run on a production DOD system. VAMI can be configured to load any number of external modules, but only a specific few are provided and supported by VMware. Additional, unexpected modules must be removed.
Checks: C-60329r888482_chk

At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2&gt;/dev/null|awk '/server\.modules/,/\)/'|sed -e 's/^[ ]*//' Expected result: server.modules=( "mod_access", "mod_accesslog", "mod_proxy", "mod_cgi", "mod_rewrite", "mod_magnet", "mod_setenv", #7 ) If the output does not match the expected result, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Fix: F-60272r888483_fix

Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf Configure the "server.modules" section to the following: server.modules = ( "mod_access", "mod_accesslog", "mod_proxy", "mod_cgi", "mod_rewrite", ) server.modules += ( "mod_magnet" ) Restart the service with the following command: # vmon-cli --restart applmgmt

b
VAMI must have Multipurpose Internet Mail Extensions (MIME) that invoke operating system shell programs disabled.
CM-7 - Medium - CCI-000381 - V-256655 - SV-256655r888487_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
VCLD-70-000011
Vuln IDs
  • V-256655
Rule IDs
  • SV-256655r888487_rule
Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or the user could use the function in an unintentional manner. A MIME tells the web server what type of program various file types and extensions are and what external utilities or programs are needed to execute the file type. There is no reason for VAMI to have MIME types configured for shell scripts.
Checks: C-60330r888485_chk

At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2&gt;/dev/null|awk '/mimetype\.assign/,/\)/'|grep -E "\.sh|\.csh" If the command returns any value, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Fix: F-60273r888486_fix

Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf Remove any lines that reference ".sh" or ".csh" from the "mimetype.assign" section. Restart the service with the following command: # vmon-cli --restart applmgmt

b
VAMI must explicitly disable Multipurpose Internet Mail Extensions (MIME) mime mappings based on "Content-Type".
CM-7 - Medium - CCI-000381 - V-256656 - SV-256656r888490_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
VCLD-70-000012
Vuln IDs
  • V-256656
Rule IDs
  • SV-256656r888490_rule
Controlling what a user of a hosted application can access is part of the security posture of the web server. Any time a user can access more functionality than is needed for the operation of the hosted application poses a security issue. A user with too much access can view information that is not needed for the user's job role, or the user could use the function in an unintentional manner. A MIME tells the web server what type of program various file types and extensions are and what external utilities or programs are needed to execute the file type. A limited number of MIME types must be configured manually, and automatic mapping must be disabled.
Checks: C-60331r888488_chk

At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2&gt;/dev/null|grep "mimetype.use-xattr"|sed 's: ::g' Expected result: mimetype.use-xattr="disable" If the output does not match the expected result, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Fix: F-60274r888489_fix

Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf Add or reconfigure the following value: mimetype.use-xattr = "disable" Restart the service with the following command: # vmon-cli --restart applmgmt

b
VAMI must remove all mappings to unused scripts.
CM-7 - Medium - CCI-000381 - V-256657 - SV-256657r888493_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
VCLD-70-000013
Vuln IDs
  • V-256657
Rule IDs
  • SV-256657r888493_rule
Scripts allow server-side processing on behalf of the hosted application user or as processes needed in the implementation of hosted applications. Removing scripts not needed for application operation or deemed vulnerable helps to secure the web server. To ensure scripts are not added to the web server and run maliciously, script mappings that are not needed or used by the web server for hosted application operation must be removed.
Checks: C-60332r888491_chk

At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2&gt;/dev/null|awk '/cgi\.assign/,/\)/'|sed -e 's/^[ ]*//' Expected result: cgi.assign = ( ".py" =&gt; "/usr/bin/python", ".cgi" =&gt; "/usr/bin/python", # 2 ) If the output does not match the expected result, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Fix: F-60275r888492_fix

Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf Configure the "cgi.assign" section to the following: cgi.assign = ( ".py" => "/usr/bin/python", ".cgi" =>"/usr/bin/python" ) Restart the service with the following command: # vmon-cli --restart applmgmt

b
VAMI must have resource mappings set to disable the serving of certain file types.
CM-7 - Medium - CCI-000381 - V-256658 - SV-256658r918987_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
VCLD-70-000014
Vuln IDs
  • V-256658
Rule IDs
  • SV-256658r918987_rule
Resource mapping is the process of tying a particular file type to a process in the web server that can serve that type of file to a requesting client and to identify which file types are not to be delivered to a client. By not specifying which files can and which files cannot be served to a user, VAMI could deliver sensitive files.
Checks: C-60333r918985_chk

At the command prompt, run the following command: # grep "url.access-deny" /opt/vmware/etc/lighttpd/lighttpd.conf Expected result: url.access-deny = ( "~", ".inc" ) If the output does not match the expected result, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Fix: F-60276r918986_fix

Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf Add or reconfigure the following value: url.access-deny = ( "~", ".inc" ) Restart the service with the following command: # vmon-cli --restart applmgmt

b
VAMI must not have the Web Distributed Authoring (WebDAV) servlet installed.
CM-7 - Medium - CCI-000381 - V-256659 - SV-256659r888499_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
VCLD-70-000015
Vuln IDs
  • V-256659
Rule IDs
  • SV-256659r888499_rule
A web server can be installed with functionality that, by its nature, is not secure. WebDAV is an extension to the HTTP protocol that, when developed, was meant to allow users to create, change, and move documents on a server, typically a web server or web share. Allowing this functionality, development, and deployment is much easier for web authors. WebDAV is not widely used and has serious security concerns because it may allow clients to modify unauthorized files on the web server.
Checks: C-60334r888497_chk

At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2&gt;/dev/null|awk '/server\.modules/,/\)/'|grep mod_webdav If any value is returned, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Fix: F-60277r888498_fix

Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf Delete or comment out the "mod_webdav" line. Note: The line may be in an included config and not in the parent config itself. Restart the service with the following command: # vmon-cli --restart applmgmt

b
VAMI must prevent hosted applications from exhausting system resources.
CM-7 - Medium - CCI-000381 - V-256660 - SV-256660r888502_rule
RMF Control
CM-7
Severity
Medium
CCI
CCI-000381
Version
VCLD-70-000016
Vuln IDs
  • V-256660
Rule IDs
  • SV-256660r888502_rule
Most of the attention to denial-of-service (DoS) attacks focuses on ensuring that systems and applications are not victims of these attacks. However, these systems and applications must also be secured against use to launch such an attack against others. A variety of technologies exist to limit or, in some cases, eliminate the effects of DoS attacks. Limiting system resources that are allocated to any user to a bare minimum may also reduce the ability of users to launch some DoS attacks. One DoS mitigation is to prevent VAMI from keeping idle connections open for too long.
Checks: C-60335r888500_chk

At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2&gt;/dev/null|grep "server.max-keep-alive-idle"|sed 's: ::g' Expected result: server.max-keep-alive-idle=30 If the output does not match the expected result, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Fix: F-60278r888501_fix

Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf file. Add or reconfigure the following value: server.max-keep-alive-idle = 30 Restart the service with the following command: # vmon-cli --restart applmgmt

b
VAMI must protect the keystore from unauthorized access.
IA-5 - Medium - CCI-000186 - V-256661 - SV-256661r888505_rule
RMF Control
IA-5
Severity
Medium
CCI
CCI-000186
Version
VCLD-70-000017
Vuln IDs
  • V-256661
Rule IDs
  • SV-256661r888505_rule
The web server's private key is used to prove the identity of the server to clients and securely exchange the shared secret key used to encrypt communications between the web server and clients. By gaining access to the private key, an attacker can pretend to be an authorized server and decrypt the Secure Sockets Layer (SSL) traffic between a client and the web server.
Checks: C-60336r888503_chk

At the command prompt, run the following command: # stat -c "%n has %a permissions and is owned by %U:%G" /etc/applmgmt/appliance/server.pem Expected result: /etc/applmgmt/appliance/server.pem has 600 permissions and is owned by root:root If the output does not match the expected result, this is a finding.

Fix: F-60279r888504_fix

At the command prompt, run the following commands: # chown root:root /etc/applmgmt/appliance/server.pem # chmod 600 /etc/applmgmt/appliance/server.pem

b
VAMI must protect against or limit the effects of HTTP types of denial-of-service (DoS) attacks.
SC-5 - Medium - CCI-001094 - V-256662 - SV-256662r888508_rule
RMF Control
SC-5
Severity
Medium
CCI
CCI-001094
Version
VCLD-70-000018
Vuln IDs
  • V-256662
Rule IDs
  • SV-256662r888508_rule
In UNIX and related computer operating systems, a file descriptor is an indicator used to access a file or other input/output resource, such as a pipe or network connection. File descriptors index into a per-process file descriptor table maintained by the kernel, which in turn indexes into a systemwide table of files opened by all processes, called the file table. As a single-threaded server, Lighttpd must be limited in the number of file descriptors that can be allocated. This will prevent Lighttpd from being used in a form of DoS attack against the operating system.
Checks: C-60337r888506_chk

At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2&gt;/dev/null|grep "server.max-fds"|sed 's: ::g' Expected result: server.max-fds=2048 If the output does not match the expected result, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Fix: F-60280r888507_fix

Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf Add or reconfigure the following value: server.max-fds = 2048 Restart the service with the following command: # vmon-cli --restart applmgmt

b
VAMI must set the encoding for all text Multipurpose Internet Mail Extensions (MIME) types to UTF-8.
SI-10 - Medium - CCI-001310 - V-256663 - SV-256663r888511_rule
RMF Control
SI-10
Severity
Medium
CCI
CCI-001310
Version
VCLD-70-000019
Vuln IDs
  • V-256663
Rule IDs
  • SV-256663r888511_rule
Invalid user input occurs when a user inserts data or characters into a hosted application's data entry field and the hosted application is unprepared to process that data. This results in unanticipated application behavior, potentially leading to an application compromise. Invalid user input is one of the primary methods employed when attempting to compromise an application. An attacker can also enter Unicode into hosted applications in an effort to break out of the document home or root home directory or to bypass security checks.
Checks: C-60338r888509_chk

At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2&gt;/dev/null|awk '/mimetype\.assign/,/\)/'|grep "text/"|grep -v "charset=utf-8"|sed -e 's/^[ ]*//' If the command returns any value, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Fix: F-60281r888510_fix

Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf Navigate to the "mimetype.assign" block. Replace all the mappings whose assigned type is "text/*" with mappings for UTF-8 encoding. For example: ".log" => "text/plain; charset=utf-8", ".conf" => "text/plain; charset=utf-8", ".text" => "text/plain; charset=utf-8", ".txt" => "text/plain; charset=utf-8", ".spec" => "text/plain; charset=utf-8", ".dtd" => "text/xml; charset=utf-8", ".xml" => "text/xml; charset=utf-8", Restart the service with the following command: # vmon-cli --restart applmgmt

b
VAMI must disable directory browsing.
SI-11 - Medium - CCI-001312 - V-256664 - SV-256664r888514_rule
RMF Control
SI-11
Severity
Medium
CCI
CCI-001312
Version
VCLD-70-000020
Vuln IDs
  • V-256664
Rule IDs
  • SV-256664r888514_rule
The goal is to completely control the web user's experience in navigating any portion of the web document root directories. Ensuring all web content directories have at least the equivalent of an "index.html" file is a significant factor to accomplish this end. Enumeration techniques, such as Uniform Resource Locator (URL) parameter manipulation, rely on being able to obtain information about the web server's directory structure by locating directories without default pages. In this scenario, the web server will display to the user a listing of the files in the directory being accessed. By having a default hosted application web page, the anonymous web user will not obtain directory browsing information or an error message that reveals the server type and version.
Checks: C-60339r888512_chk

At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2&gt;/dev/null|grep "dir-listing.activate"|sed 's: ::g' Expected result: dir-listing.activate="disable" If the output does not match the expected result, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Fix: F-60282r888513_fix

Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf Add or reconfigure the following value: dir-listing.activate = "disable" Restart the service with the following command: # vmon-cli --restart applmgmt

b
VAMI must not be configured to use "mod_status".
SI-11 - Medium - CCI-001312 - V-256665 - SV-256665r888517_rule
RMF Control
SI-11
Severity
Medium
CCI
CCI-001312
Version
VCLD-70-000021
Vuln IDs
  • V-256665
Rule IDs
  • SV-256665r888517_rule
Any application providing too much information in error logs and in administrative messages to the screen risks compromising the data and security of the application and system. VAMI must only generate error messages that provide information necessary for corrective actions without revealing sensitive or potentially harmful information in error logs and administrative messages. The "mod_status" module generates the status overview of the webserver. The information covers the following: - Uptime. - Average throughput. - Current throughput. - Active connections and their state. While this information is useful on a development system, production systems must not have "mod_status" enabled.
Checks: C-60340r888515_chk

At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2&gt;/dev/null|awk '/server\.modules/,/\)/'|grep mod_status If any value is returned, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Fix: F-60283r888516_fix

Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf. Remove the line containing "mod_status". Note: The line may be in an included config and not in the parent config. Restart the service with the following command: # vmon-cli --restart applmgmt

b
VAMI must have debug logging disabled.
SI-11 - Medium - CCI-001312 - V-256666 - SV-256666r888520_rule
RMF Control
SI-11
Severity
Medium
CCI
CCI-001312
Version
VCLD-70-000022
Vuln IDs
  • V-256666
Rule IDs
  • SV-256666r888520_rule
Information needed by an attacker to begin looking for possible vulnerabilities in a web server includes any information about the web server and plug-ins or modules being used. When debugging or trace information is enabled in a production web server, information about the web server, such as web server type, version, patches installed, plug-ins and modules installed, type of code being used by the hosted application, and any backends being used for data storage may be displayed. Because this information may be placed in logs and general messages during normal operation of the web server, an attacker does not need to cause an error condition to gain this information.
Checks: C-60341r888518_chk

At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2&gt;/dev/null|grep "debug.log-request-handling"|sed 's: ::g' Expected result: debug.log-request-handling="disable" If the output does not match the expected result, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Fix: F-60284r888519_fix

Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf Add or reconfigure the following value: debug.log-request-handling = "disable" Restart the service with the following command: # vmon-cli --restart applmgmt

b
VAMI must be protected from being stopped by a nonprivileged user.
SC-5 - Medium - CCI-002385 - V-256667 - SV-256667r888523_rule
RMF Control
SC-5
Severity
Medium
CCI
CCI-002385
Version
VCLD-70-000023
Vuln IDs
  • V-256667
Rule IDs
  • SV-256667r888523_rule
An attacker has at least two reasons to stop a web server. The first is to cause a denial of service, and the second is to put in place changes the attacker made to the web server configuration. Therefore, only administrators should ever be able to stop VAMI. The VAMI process is configured out of the box to be owned by root. This configuration must be verified and maintained.
Checks: C-60342r888521_chk

At the command prompt, run the following command: # ps -f -U root | awk '$0 ~ /vami-lighttpd/ &amp;&amp; $0 !~ /awk/ {print $1}' Expected result: root If the output does not match the expected result, this is a finding.

Fix: F-60285r888522_fix

Navigate to and open: /usr/lib/systemd/system/vami-lighttp.service Under the "[Service]" section, remove the line that beings with "User=". Restart the service with the following command: # vmon-cli --restart applmgmt

b
VAMI must implement Transport Layer Security (TLS) 1.2 exclusively.
SC-8 - Medium - CCI-002418 - V-256668 - SV-256668r888526_rule
RMF Control
SC-8
Severity
Medium
CCI
CCI-002418
Version
VCLD-70-000024
Vuln IDs
  • V-256668
Rule IDs
  • SV-256668r888526_rule
TLS is a required transmission protocol for a web server hosting controlled information. The use of TLS provides confidentiality of data in transit between the web server and client. FIPS 140-2 approved TLS versions must be enabled, and non-FIPS-approved Secure Sockets Layer (SSL) versions must be disabled. VAMI comes configured to use only TLS 1.2. This configuration must be verified and maintained. Satisfies: SRG-APP-000439-WSR-000156, SRG-APP-000442-WSR-000182
Checks: C-60343r888524_chk

At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2&gt;/dev/null|grep "ssl.use"|sed 's: ::g' Expected result: ssl.use-sslv2="disable" ssl.use-sslv3="disable" ssl.use-tlsv10="disable" ssl.use-tlsv11="disable" ssl.use-tlsv12="enable" If the output does not match the expected result, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Fix: F-60286r888525_fix

Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf Replace all "ssl.use-*" lines with the following: ssl.use-sslv2="disable" ssl.use-sslv3="disable" ssl.use-tlsv10="disable" ssl.use-tlsv11="disable" ssl.use-tlsv12="enable" Restart the service with the following command: # vmon-cli --restart applmgmt

b
VAMI must force clients to select the most secure cipher.
CM-6 - Medium - CCI-000366 - V-256669 - SV-256669r888529_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
VCLD-70-000025
Vuln IDs
  • V-256669
Rule IDs
  • SV-256669r888529_rule
During a Transport Layer Security (TLS) session negotiation, when choosing a cipher during a handshake, normally the client's preference is used. This is potentially problematic as a malicious, dated, or poorly configured client could select the most insecure cipher offered by the server, even if it supports stronger ones. If "ssl.honor-cipher-order" is enabled, the "ssl.cipher-list" setting will be treated as an ordered list of cipher values from most preferred to least, left to right.
Checks: C-60344r888527_chk

At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2&gt;/dev/null|grep "ssl\.honor-cipher-order"|sed 's: ::g' Expected result: ssl.honor-cipher-order = "enable" If the output does not match the expected result, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Fix: F-60287r888528_fix

Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf Add or reconfigure the following setting: ssl.honor-cipher-order = "enable" Restart the service with the following command: # vmon-cli --restart applmgmt

b
VAMI must disable client-initiated Transport Layer Security (TLS) renegotiation.
CM-6 - Medium - CCI-000366 - V-256670 - SV-256670r888532_rule
RMF Control
CM-6
Severity
Medium
CCI
CCI-000366
Version
VCLD-70-000026
Vuln IDs
  • V-256670
Rule IDs
  • SV-256670r888532_rule
All versions of the Secure Sockets Layer (SSL) and TLS protocols (up to and including TLS 1.2) are vulnerable to a man-in-the-middle attack (CVE-2009-3555) during a renegotiation. This vulnerability allows an attacker to "prefix" a chosen plaintext to the HTTP request as seen by the web server. The protocols have since been amended by RFC 5746, but the fix must be supported by both client and server to be effective. While Lighttpd and the underlying OpenSSL libraries are no longer vulnerable, steps must be taken to account for older clients that do not support RFC 5746. To this end, Lighttpd disables client-initiated renegotiation entirely by default. This configuration must be validated and maintained.
Checks: C-60345r888530_chk

At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2&gt;/dev/null|grep "ssl\.disable-client-renegotiation"|sed 's: ::g' If no line is returned, this is not a finding. If "ssl.disable-client-renegotiation" is set to "disabled", this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Fix: F-60288r888531_fix

Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf Remove any setting for "ssl.disable-client-renegotiation". Restart the service with the following command: # vmon-cli --restart applmgmt

b
VAMI must be configured to hide the server type and version in client responses.
SI-11 - Medium - CCI-001312 - V-256671 - SV-256671r888535_rule
RMF Control
SI-11
Severity
Medium
CCI
CCI-001312
Version
VCLD-70-000027
Vuln IDs
  • V-256671
Rule IDs
  • SV-256671r888535_rule
Web servers will often display error messages to client users, displaying enough information to aid in the debugging of the error. The information given back in error messages may display the web server type, version, patches installed, plug-ins and modules installed, type of code being used by the hosted application, and any backends being used for data storage. This information could be used by an attacker to blueprint what type of attacks might be successful. Therefore, VAMI must be configured to hide the server version at all times.
Checks: C-60346r888533_chk

At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2&gt;/dev/null|grep "server.tag"|sed 's: ::g' Expected result: server.tag="vami" If the output does not match the expected result, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Fix: F-60289r888534_fix

Navigate to and open: /etc/applmgmt/appliance/lighttpd.conf Add or reconfigure the following value: server.tag = "vami" Restart the service with the following command: # vmon-cli --restart applmgmt

c
VAMI must enable FIPS mode.
IA-7 - High - CCI-000803 - V-256672 - SV-256672r888538_rule
RMF Control
IA-7
Severity
High
CCI
CCI-000803
Version
VCLD-70-000056
Vuln IDs
  • V-256672
Rule IDs
  • SV-256672r888538_rule
Encryption is only as good as the encryption modules used. Unapproved cryptographic module algorithms cannot be verified and cannot be relied on to provide confidentiality or integrity, and DOD data may be compromised due to weak algorithms. FIPS 140-2 is the current standard for validating cryptographic modules.
Checks: C-60347r888536_chk

At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2&gt;/dev/null|grep "server.fips-mode"|sed -e 's/^[ ]*//' Expected result: server.fips-mode = "enable" If the output does not match the expected result, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Fix: F-60290r888537_fix

Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf Add or reconfigure the following value: server.fips-mode = "enable" Restart the service with the following command: # vmon-cli --restart applmgmt