The vAMI must use the sfcb HTTPS port for communication with Lighttpd.

From VMW vRealize Automation 7.x vAMI Security Technical Implementation Guide

Part of SRG-APP-000142-AS-000014

Associated with: CCI-000382

SV-100869r1_rule The vAMI must use the sfcb HTTPS port for communication with Lighttpd.

Vulnerability discussion

Some networking protocols may not meet organizational security requirements to protect data and components. Application servers natively host a number of various features, such as management interfaces, httpd servers and message queues. These features all run on TCPIP ports. This creates the potential that the vendor may choose to utilize port numbers or network services that have been deemed unusable by the organization. The application server must have the capability to both reconfigure and disable the assigned ports without adversely impacting application server operation capabilities. For a list of approved ports and protocols, reference the DoD ports and protocols web site at https://powhatan.iiie.disa.mil/ports/cal.html.

Check content

At the command prompt, execute the following command to determine the sfcb HTTPS port: grep httpsPort /opt/vmware/etc/sfcb/sfcb.cfg | cut -d ':' -f 2 | tr -d ' ' If the httpsPort configuration is missing or commented out, this is a finding. At the command prompt, type the following command to determine the port that Lighttpd is using to communicate with sfcb: grep cimom -A 7 /opt/vmware/etc/lighttpd/lighttpd.conf | grep port | cut -d '=' -f 2 | tr -d '>' | tr -d ' ' | tr -d '"' If Lighttpd is not using the sfcb HTTPS port for communication with the vAMI, this is a finding.

Fix text

At the command prompt, type the following command to determine the sfcb httpsPort: grep httpsPort /opt/vmware/etc/sfcb/sfcb.cfg | cut -d ':' -f 2 | tr -d ' ' Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Navigate to the '$HTTP["url"] =~ "^/cimom"' block. Configure the lighttpd.conf file with the following block: $HTTP["url"] =~ "^/cimom" { proxy.server = ( "" => (( "host" => "127.0.0.1", "port" => "" )) ) } Note: Substitute in lighttpd.conf with the httpsPort number found in sfcb.cfg.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.

Powered by sagemincer