The vAMI must protect log information from unauthorized deletion.

From VMW vRealize Automation 7.x vAMI Security Technical Implementation Guide

Associated with: CCI-000164

SV-100857r1_rule The vAMI must protect log information from unauthorized deletion.

Vulnerability discussion

If log data were to become compromised, then competent forensic analysis and discovery of the true source of potentially malicious system activity is difficult, if not impossible, to achieve. Application servers contain admin interfaces that allow reading and manipulation of log records. Therefore, these interfaces should not allow for unfettered access to those records. Application servers also write log data to log files that are stored on the OS, so appropriate file permissions must also be used to restrict access. Log information includes all information (e.g., log records, log settings, transaction logs, and log reports) needed to successfully log information system activity. Application servers must protect log information from unauthorized deletion.

Check content

At the command prompt, execute the following command: ls -lL /opt/vmware/var/log/vami /opt/vmware/var/log/sfcb If log files are not owned by root, this is a finding.

Fix text

At the command prompt, enter the following command: chown root:root Note: Replace with the file(s) that are not owned by root.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.