What changed in VMware vRealize Automation 7.x Lighttpd STIG V1R2V1R2 changes

VMware vRealize Automation 7.x Lighttpd STIG V1R2 (2023-10-25) replaced V1R1 (2018-09-28): 62 checks added, 62 removed. It has 62 checks, against 62 in V1R1.

V1R2 checklistV1R1 checklist Compare V1R1 and V1R2 in STIG Compare

  • 62 added
  • 62 removed
  • 0 updated

Added in V1R2 (62)

  • V-240215CAT IILighttpd must limit the number of simultaneous requests.
  • V-240216CAT IILighttpd must be configured with FIPS 140-2 compliant ciphers for https connections.
  • V-240217CAT IILighttpd must be configured to use the SSL engine.
  • V-240218CAT IILighttpd must be configured to use mod_accesslog.
  • V-240219CAT IILighttpd must generate log records for system startup and shutdown.
  • V-240220CAT IILighttpd must produce log records containing sufficient information to establish what type of events occurred.
  • V-240221CAT IILighttpd must produce log records containing sufficient information to establish when (date and time) events occurred.
  • V-240222CAT IILighttpd must produce log records containing sufficient information to establish where within the web server the events occurred.
  • V-240223CAT IILighttpd must produce log records containing sufficient information to establish the source of events.
  • V-240224CAT IILighttpd must produce log records containing sufficient information to establish the outcome (success or failure) of events.
  • V-240225CAT IILighttpd must have the correct ownership on the log files to ensure they are only be accessible by privileged users.
  • V-240226CAT IILighttpd must have the correct group-ownership on the log files to ensure they are only be accessible by privileged users.
  • V-240227CAT IILighttpd must have the correct permissions on the log files to ensure they are only be accessible by privileged users.
  • V-240228CAT IILighttpd must have the correct ownership on the log files to ensure they are protected from unauthorized modification.
  • V-240229CAT IILighttpd must have the correct group-ownership on the log files to ensure they are protected from unauthorized modification.
  • V-240230CAT IILighttpd must have the correct permissions on the log files to ensure they are protected from unauthorized modification.
  • V-240231CAT IILighttpd must have the correct ownership on the log files to ensure they are protected from unauthorized deletion.
  • V-240232CAT IILighttpd must have the correct group-ownership on the log files to ensure they are protected from unauthorized deletion.
  • V-240233CAT IILighttpd must have the correct permissions on the log files to ensure they are protected from unauthorized deletion.
  • V-240234CAT IILighttpd log data and records must be backed up onto a different system or media.
  • V-240235CAT IILighttpd files must be verified for their integrity before being added to a production web server.
  • V-240236CAT IILighttpd expansion modules must be verified for their integrity before being added to a production web server.
  • V-240237CAT IILighttpd must prohibit unnecessary services, functions or processes.
  • V-240238CAT IILighttpd proxy settings must be configured.
  • V-240239CAT ILighttpd must only contain components that are operationally necessary.
  • V-240240CAT IILighttpd must have MIME types for csh or sh shell programs disabled.
  • V-240241CAT IILighttpd must only enable mappings to necessary and approved scripts.
  • V-240242CAT IILighttpd must have resource mappings set to disable the serving of certain file types.
  • V-240243CAT IILighttpd must not have the Web Distributed Authoring (WebDAV) module installed.
  • V-240244CAT IILighttpd must not have the webdav configuration file included.
  • V-240245CAT IILighttpd must prevent hosted applications from exhausting system resources.
  • V-240246CAT ILighttpd must not use symbolic links in the Lighttpd web content directory tree.
  • V-240247CAT IILighttpd must be configured to use port 5480.
  • V-240248CAT IILighttpd must use SSL/TLS protocols in order to secure passwords during transmission from the client.
  • V-240249CAT IILighttpd must have private key access restricted.
  • V-240250CAT IILighttpd must be configured to use only FIPS 140-2 approved ciphers.
  • V-240251CAT ILighttpd must prohibit non-privileged accounts from accessing the directory tree, the shell, or other operating system functions and utilities.
  • V-240252CAT ILighttpd must have the latest version installed.
  • V-240253CAT IIThe Lighttpd baseline must be maintained.
  • V-240254CAT IILighttpd must protect against or limit the effects of HTTP types of Denial of Service (DoS) attacks.
  • V-240255CAT IILighttpd must disable directory browsing.
  • V-240256CAT IILighttpd must not be configured to use mod_status.
  • V-240257CAT IILighttpd must have debug logging disabled.
  • V-240258CAT ILighttpd must be configured to utilize the Common Information Model Object Manager.
  • V-240259CAT IILighttpd must restrict inbound connections from nonsecure zones.
  • V-240260CAT IILighttpd must be configured to use syslog.
  • V-240261CAT IILighttpd must be configured to use syslog.
  • V-240262CAT IIThe web server must use a logging mechanism that is configured to provide a warning to the ISSO and SA when allocated record storage volume reaches 75% of maximum log record storage capacity.
  • V-240263CAT IILighttpd audit records must be mapped to a time stamp.
  • V-240264CAT IILighttpd must record time stamps for log records to a minimum granularity of time.
  • V-240265CAT IILighttpd must prohibit non-privileged accounts from accessing the application, libraries, and configuration files.
  • V-240266CAT IILighttpd must not be configured to listen to unnecessary ports.
  • V-240267CAT IILighttpd must be configured with FIPS 140-2 compliant ciphers for https connections.
  • V-240268CAT IILighttpd must be protected from being stopped by a non-privileged user.
  • V-240269CAT IILighttpd must be configured to use the SSL engine.
  • V-240270CAT IILighttpd must be configured to use the SSL engine.
  • V-240271CAT ILighttpd must use an approved TLS version for encryption.
  • V-240272CAT IILighttpd must remove all export ciphers to transmitted information.
  • V-240273CAT IILighttpd must be configured to use SSL.
  • V-240274CAT IILighttpd must have the latest approved security-relevant software updates installed.
  • V-240275CAT IILighttpd must disable IP forwarding.
  • V-258452CAT IThe version of vRealize Automation 7.x Lighttpd running on the system must be a supported version.

Removed since V1R1 (62)

  • V-89219CAT IILighttpd must limit the number of simultaneous requests.
  • V-89221CAT IILighttpd must be configured with FIPS 140-2 compliant ciphers for https connections.
  • V-89223CAT IILighttpd must be configured to use the SSL engine.
  • V-89225CAT IILighttpd must be configured to use mod_accesslog.
  • V-89227CAT IILighttpd must generate log records for system startup and shutdown.
  • V-89229CAT IILighttpd must capture, record, and log the IP address associated with a user session.
  • V-89231CAT IILighttpd must produce log records containing sufficient information to establish what type of events occurred.
  • V-89233CAT IILighttpd must produce log records containing sufficient information to establish when (date and time) events occurred.
  • V-89235CAT IILighttpd must produce log records containing sufficient information to establish where within the web server the events occurred.
  • V-89237CAT IILighttpd must produce log records containing sufficient information to establish the source of events.
  • V-89239CAT IILighttpd must produce log records containing sufficient information to establish the outcome (success or failure) of events.
  • V-89241CAT IILighttpd must have the correct ownership on the log files to ensure they are only be accessible by privileged users.
  • V-89243CAT IILighttpd must have the correct group-ownership on the log files to ensure they are only be accessible by privileged users.
  • V-89245CAT IILighttpd must have the correct permissions on the log files to ensure they are only be accessible by privileged users.
  • V-89247CAT IILighttpd must have the correct ownership on the log files to ensure they are protected from unauthorized modification.
  • V-89249CAT IILighttpd must have the correct ownership on the log files to ensure they are protected from unauthorized deletion.
  • V-89251CAT IILighttpd log data and records must be backed up onto a different system or media.
  • V-89253CAT IILighttpd files must be verified for their integrity before being added to a production web server.
  • V-89255CAT IILighttpd expansion modules must be verified for their integrity before being added to a production web server.
  • V-89257CAT IILighttpd must prohibit unnecessary services, functions or processes.
  • V-89259CAT ILighttpd must only contain components that are operationally necessary.
  • V-89261CAT IILighttpd must have MIME types for csh or sh shell programs disabled.
  • V-89263CAT IILighttpd must only enable mappings to necessary and approved scripts.
  • V-89265CAT IILighttpd must have resource mappings set to disable the serving of certain file types.
  • V-89267CAT IILighttpd must not have the Web Distributed Authoring (WebDAV) module installed.
  • V-89269CAT IILighttpd must not have the webdav configuration file included.
  • V-89271CAT IILighttpd must prevent hosted applications from exhausting system resources.
  • V-89273CAT ILighttpd must not use symbolic links in the Lighttpd web content directory tree.
  • V-89275CAT IILighttpd must be configured to use port 5480.
  • V-89277CAT IILighttpd must use SSL/TLS protocols in order to secure passwords during transmission from the client.
  • V-89279CAT IILighttpd must have private key access restricted.
  • V-89281CAT IILighttpd must be configured to use only FIPS 140-2 approved ciphers.
  • V-89283CAT ILighttpd must prohibit non-privileged accounts from accessing the directory tree, the shell, or other operating system functions and utilities.
  • V-89285CAT ILighttpd must have the latest version installed.
  • V-89287CAT IIThe Lighttpd baseline must be maintained.
  • V-89289CAT IILighttpd must protect against or limit the effects of HTTP types of Denial of Service (DoS) attacks.
  • V-89291CAT IILighttpd must disable directory browsing.
  • V-89293CAT IILighttpd must not be configured to use mod_status.
  • V-89295CAT IILighttpd must have debug logging disabled.
  • V-89297CAT ILighttpd must be configured to utilize the Common Information Model Object Manager.
  • V-89299CAT IIThe web server must use a logging mechanism that is configured to provide a warning to the ISSO and SA when allocated record storage volume reaches 75% of maximum log record storage capacity.
  • V-89301CAT IILighttpd audit records must be mapped to a time stamp.
  • V-89303CAT IILighttpd must record time stamps for log records to a minimum granularity of time.
  • V-89305CAT IILighttpd must prohibit non-privileged accounts from accessing the application, libraries, and configuration files.
  • V-89307CAT IILighttpd must not be configured to listen to unnecessary ports.
  • V-89309CAT IILighttpd must be configured with FIPS 140-2 compliant ciphers for https connections.
  • V-89311CAT IILighttpd must be protected from being stopped by a non-privileged user.
  • V-89313CAT IILighttpd must be configured to use the SSL engine.
  • V-89315CAT IILighttpd must be configured to use the SSL engine.
  • V-89317CAT ILighttpd must use an approved TLS version for encryption.
  • V-89319CAT IILighttpd must remove all export ciphers to transmitted information.
  • V-89321CAT IILighttpd must be configured to use SSL.
  • V-89323CAT IILighttpd must have the latest approved security-relevant software updates installed.
  • V-89325CAT IILighttpd must disable IP forwarding.
  • V-90325CAT IILighttpd must have the correct group-ownership on the log files to ensure they are protected from unauthorized modification.
  • V-90327CAT IILighttpd must have the correct permissions on the log files to ensure they are protected from unauthorized modification.
  • V-90329CAT IILighttpd must have the correct group-ownership on the log files to ensure they are protected from unauthorized deletion.
  • V-90331CAT IILighttpd must have the correct permissions on the log files to ensure they are protected from unauthorized deletion.
  • V-90333CAT IILighttpd proxy settings must be configured.
  • V-90335CAT IILighttpd must restrict inbound connections from nonsecure zones.
  • V-90337CAT IILighttpd must be configured to use syslog.
  • V-90339CAT IILighttpd must be configured to use syslog.

How these changes are found

Checks are matched across the two releases by V-number. A check counts as updated when DISA gave it a new rule revision (the r number in its SV-…_rule id) and its title, severity, check text, fix text, discussion, CCIs or other fields changed — the same comparison STIG Compare makes. Added checks are new V-numbers; removed checks are V-numbers V1R2 no longer has.

Comparing other releases, or this one against an older release? Pick any two in STIG Compare.