← Back to VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide

V-241668

CAT I (High)

tc Server API web server application directories must not be accessible to anonymous user.

Rule ID

SV-241668r879631_rule

STIG

VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide

Version

V1R2

CCIs

CCI-001082

Discussion

In order to properly monitor the changes to the web server and the hosted applications, logging must be enabled. Along with logging being enabled, each record must properly contain the changes made and the names of those who made the changes. Allowing anonymous users the capability to change the web server or the hosted application will not generate proper log information that can then be used for forensic reporting in the case of a security issue. Allowing anonymous users to make changes will also grant change capabilities to anybody without forcing a user to authenticate before the changes can be made.

Check Content

At the command prompt, find any world accessible files by executing the following commands:

ls -alR /usr/lib/vmware-vcops/tomcat-enterprise/bin /usr/lib/vmware-vcops/tomcat-enterprise/conf | grep -E '^-' | awk '$1 !~ /---$/ {print}'

If the command produces any output, this is a finding.

Fix Text

At the command prompt, execute the following commands:

find /usr/lib/vmware-vcops/tomcat-enterprise/conf -type f -exec chmod o=--- {} \;

find /usr/lib/vmware-vcops/tomcat-enterprise/bin -type f -exec chmod o=--- {} \;