STIGQter: STIG Summary: VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Sep 2018:

tc Server VCO must be configured with the RemoteIpValve in order to produce log records containing the client IP information as the source and destination and not the load balancer or proxy IP information with each event.

DISA Rule

SV-100609r1_rule

Vulnerability Number

V-89959

Group Title

SRG-APP-000098-WSR-000060

Rule Version

VRAU-TC-000210

Severity

CAT II

CCI(s)

• CCI-000133 - The information system generates audit records containing information that establishes the source of the event.

Weight

10

Fix Recommendation

Navigate to and open /etc/vco/app-server/server.xml.

Navigate to and locate <Host>.

Configure the <Host> node with the <RemoteIpValve> below.

Note: The "RemoteIpValve" should be configured as follows:
<Valve className="org.apache.catalina.valves.RemoteIpValve"
remoteIpHeader="x-forwarded-for"
remoteIpProxiesHeader="x-forwarded-by"
internalProxies=".*"
protocolHeader="x-forwarded-proto" />

Check Contents

At the command prompt, execute the following command:

tail /storage/log/vmware/vco/app-server/localhost_access_log.txt

If actual client IP information, not load balancer or proxy server, is not being recorded, this is a finding.

Vulnerability Number

V-89959

Documentable

False

Rule Version

VRAU-TC-000210

Severity Override Guidance

At the command prompt, execute the following command:

tail /storage/log/vmware/vco/app-server/localhost_access_log.txt

If actual client IP information, not load balancer or proxy server, is not being recorded, this is a finding.

Check Content Reference

M

Target Key

3439

Comments