STIGQter: STIG Summary: VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Sep 2018:

tc Server VCAC must generate log records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).

DISA Rule

SV-100779r1_rule

Vulnerability Number

V-90129

Group Title

SRG-APP-000374-WSR-000172

Rule Version

VRAU-TC-000770

Severity

CAT II

CCI(s)

• CCI-001890 - The information system records time stamps for audit records that can be mapped to Coordinated Universal Time (UTC) or Greenwich Mean Time (GMT).

Weight

10

Fix Recommendation

Navigate to and open /etc/vcac/server.xml.

Navigate to the <Valve className="org.apache.catalina.valves.AccessLogValve"> node.

Set the "pattern" setting with "%h %l %u %t &quot;%r&quot; %s %b".

Note: The <Valve> node should be configured per the following:

<Valve className="org.apache.catalina.valves.AccessLogValve"
checkExists="true"
directory="logs"
pattern="%h %l %u %t &quot;%r&quot; %s %b"
prefix="access_log"
requestAttributesEnabled="true"
rotatable="false"
suffix=".txt"/>

Check Contents

At the command prompt, execute the following command:

tail /storage/log/vmware/vcac/access_log.YYYY-MM-dd.txt

If the timestamp does not contain a time zone mapping, this is a finding.

Note: Substitute the actual date in the file name.

Note: In Common Log Format, a timestamp will look like [06/Feb/2016:23:12:57 +0000]. The +0000 part is the time zone mapping.

Vulnerability Number

V-90129

Documentable

False

Rule Version

VRAU-TC-000770

Severity Override Guidance

At the command prompt, execute the following command:

tail /storage/log/vmware/vcac/access_log.YYYY-MM-dd.txt

If the timestamp does not contain a time zone mapping, this is a finding.

Note: Substitute the actual date in the file name.

Note: In Common Log Format, a timestamp will look like [06/Feb/2016:23:12:57 +0000]. The +0000 part is the time zone mapping.

Check Content Reference

M

Target Key

3439

Comments