STIGQter: STIG Summary: VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Sep 2018:

tc Server VCAC must be configured with the RemoteIpValve in order to produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.

DISA Rule

SV-100611r1_rule

Vulnerability Number

V-89961

Group Title

SRG-APP-000098-WSR-000060

Rule Version

VRAU-TC-000215

Severity

CAT II

CCI(s)

• CCI-000133 - The information system generates audit records containing information that establishes the source of the event.

Weight

10

Fix Recommendation

Navigate to and open /etc/vcac/server.xml.

Navigate to and locate <Host>.

Configure the <Host> node with the <RemoteIpValve> below.

Note: The "RemoteIpValve" should be configured as follows:
<Valve className="org.apache.catalina.valves.RemoteIpValve"
httpServerPort="80"
httpsServerPort="443"
internalProxies="127\.0\.0\.1"
protocolHeader="x-forwarded-proto"
proxiesHeader="x-forwarded-by"
remoteIpHeader="x-forwarded-for"/>

Check Contents

At the command prompt, execute the following command:

tail /storage/log/vmware/vcac/access_log.YYYY-MM-dd.txt

Note: Substitute the actual date in the file name.

If actual client IP information, not load balancer or proxy server, is not being recorded, this is a finding.

Vulnerability Number

V-89961

Documentable

False

Rule Version

VRAU-TC-000215

Severity Override Guidance

At the command prompt, execute the following command:

tail /storage/log/vmware/vcac/access_log.YYYY-MM-dd.txt

Note: Substitute the actual date in the file name.

If actual client IP information, not load balancer or proxy server, is not being recorded, this is a finding.

Check Content Reference

M

Target Key

3439

Comments