Lighttpd must be configured to use mod_accesslog.

From VMware vRealize Automation 7.x Lighttpd Security Technical Implementation Guide

Associated with: CCI-000067

SV-99875r1_rule Lighttpd must be configured to use mod_accesslog.

Vulnerability discussion

Lighttpd is the administration panel for vRealize Automation. Because it is intended to provide remote access to the appliance, vRA must provide remote access information to external monitoring systems.mod_accesslog is the module in Lighttpd that configures Lighttpd to share information with external monitoring systems.

Check content

At the command prompt, execute the following command: cat /opt/vmware/etc/lighttpd/lighttpd.conf | awk '/server\.modules/,/\)/' If the value "mod_accesslog" is not listed, this is a finding.

Fix text

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf Navigate to and configure the "server.modules" section with the following value: mod_accesslog

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.