← Back to VMware vSphere 7.0 vCenter Appliance UI Security Technical Implementation Guide

V-256796

CAT II (Medium)

vSphere UI must fail to a known safe state if system initialization fails, shutdown fails, or aborts fail.

Rule ID

SV-256796r889387_rule

STIG

VMware vSphere 7.0 vCenter Appliance UI Security Technical Implementation Guide

Version

V1R2

CCIs

CCI-001190

Discussion

Determining a safe state for failure and weighing that against a potential denial of service for users depends on what type of application the web server is hosting. For the Security Token Service, it is preferable that the service abort startup on any initialization failure rather than continuing in a degraded, and potentially insecure, state.

Check Content

At the command line, run the following command: 
 
# grep EXIT_ON_INIT_FAILURE /usr/lib/vmware-vsphere-ui/server/conf/catalina.properties 
 
Expected result: 
 
org.apache.catalina.startup.EXIT_ON_INIT_FAILURE=true 
 
If the output of the command does not match the expected result, this is a finding.

Fix Text

Navigate to and open: 
 
/usr/lib/vmware-vsphere-ui/server/conf/catalina.properties 
 
Add or change the following line: 
 
org.apache.catalina.startup.EXIT_ON_INIT_FAILURE=true 
 
Restart the service with the following command: 
 
# vmon-cli --restart vsphere-ui