Details
After a security incident has occurred, investigators will often review log files to determine what happened, and determining the source of an event is crucial for forensics. The rhttpproxy must be configured for verbose logging to capture client IP addresses and the associated actions.
Solution
Navigate to and open /etc/vmware-rhttpproxy/config.xml.
Locate the
Restart the service for changes to take effect.
# vmon-cli --restart rhttpproxy
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Access Control.This control applies to the following type of system Unix.
References
- 800-53|AC-17(1)
- CAT|II
- CCI|CCI-000067
- Rule-ID|SV-240720r679673_rule
- STIG-ID|VCRP-67-000005
- Vuln-ID|V-240720
Comments
Please sign in to leave a comment.