tc Server ALL must exclude installation of utility programs, services, plug-ins, and modules not necessary for operation.

From VMware vRealize Automation 7.x tc Server Security Technical Implementation Guide

Associated with: CCI-000381

SV-100995r1_rule tc Server ALL must exclude installation of utility programs, services, plug-ins, and modules not necessary for operation.

Vulnerability discussion

Just as running unneeded services and protocols is a danger to the web server at the lower levels of the OSI model, running unneeded utilities and programs is also a danger at the application layer of the OSI model. Office suites, development tools, and graphical editors are examples of such programs that are troublesome. Because tc Server is installed as part of the entire vRA application, and not installed separately, VMware has ensured that no unnecessary utilities and programs have been included in tc Server.

Check content

Interview the ISSO. Review the web server documentation and deployed configuration to determine if utility programs, services, plug-ins, and modules not necessary for operation have been removed. If utility programs, services, plug-ins, and modules not necessary for operation have not been removed, this is a finding.

Fix text

Remove all utility programs, services, plug-ins, and modules not necessary for operation.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.