The vCenter VAMI service must limit the number of allowed simultaneous session requests.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-259137 | VCLD-80-000001 | SV-259137r1003685_rule | Medium |
| Description |
| STIG | Date |
| VMware vSphere 8.0 vCenter Appliance Management Interface (VAMI) Security Technical Implementation Guide | 2024-07-11 |
Details
| Check Text (C-62877r1003683_chk) |
| At the command prompt, run the following command: # /opt/vmware/cap_lighttpd/sbin/lighttpd -p -f /var/lib/vmware/cap-lighttpd/lighttpd.conf 2>/dev/null |grep "server.max-connections" Example result: server.max-connections = 1024 If "server.max-connections" is not configured to 1024 or less, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508 |
| Fix Text (F-62786r1003684_fix) |
| Navigate to and open: /var/lib/vmware/cap-lighttpd/lighttpd.conf Add or reconfigure the following value: server.max-connections = 1024 Restart the service with the following command: # systemctl restart cap-lighttpd |