STIGQter STIGQter: STIG Summary: VMware vRealize Operations Manager 6.x tc Server Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Sep 2018:

tc Server CaSa must be configured with the RemoteIpValve in order to produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.

DISA Rule

SV-99509r1_rule

Vulnerability Number

V-88859

Group Title

SRG-APP-000098-WSR-000060

Rule Version

VROM-TC-000220

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Navigate to and open /usr/lib/vmware-casa/casa-webapp/conf/server.xml.

Navigate to and locate <Host>.

Configure the <Host> node with the <RemoteIpValve> below.

Note : The “RemoteIpValve” should be configured as follows:

<Valve className="org.apache.catalina.valves.RemoteIpValve"
remoteIpHeader="x-forwarded-for"
remoteIpProxiesHeader="x-forwarded-by"
internalProxies=".*"
protocolHeader="x-forwarded-proto" />

Check Contents

At the command prompt, execute the following command:

grep -v 127.0 /storage/log/vcops/log/casa/localhost_access_log.YYYY-MM-dd.txt

Note: Substitute the actual date in the file name.

If actual client IP information, not load balancer or proxy server, is not being recorded, this is a finding.

Vulnerability Number

V-88859

Documentable

False

Rule Version

VROM-TC-000220

Severity Override Guidance

At the command prompt, execute the following command:

grep -v 127.0 /storage/log/vcops/log/casa/localhost_access_log.YYYY-MM-dd.txt

Note: Substitute the actual date in the file name.

If actual client IP information, not load balancer or proxy server, is not being recorded, this is a finding.

Check Content Reference

M

Target Key

3441

Comments