vCenter Server Appliance Management Interface Inaccessible on Port 5480 with error "Connection Refused"

Products

• VMware vCenter Server

Issue/Introduction

The vCenter Appliance Management Interface (VAMI) is unavailable at https://vCenter_fqdn:5480. Reviewing journalctl logs reveals a configuration error related to the vami-lighttpd service.

The error message indicates a duplicate url.access-deny variable within the lighttpd.conf file, specifically on line 497:

vami-lighttp[15961]: Duplicate config variable in conditional 0 global: url.access-deny
vami-lighttp[19586]: (/build/mts/release/bora 16973022/studio/src/vami/apps/lighttpd/src/configfile.c.1175) source: /opt/vmware/etc/lighttpd/lighttpd.conf line: 497 pos: 1 parser failed somehow near here: (EOL) 

Environment

VMware vCenter Server 8.0.x
VMware vCenter Server 7.0.x

Cause

Vami-lighttpd, fails to start and listen on port 5480 due to configuration errors caused by duplicate entries introduced during the application of Security Technical Implementation Guides (STIGs).

Upon inspecting the lighttpd configuration file (/opt/vmware/etc/lighttpd/lighttpd.conf), two entries for url.access-deny were found:
cat  /opt/vmware/etc/lighttpd/lighttpd.conf | grep url.access-deny

url.access-deny            = ( "~", ".inc" )
url.access-deny            = ("")

The first entry is the default setting:
url.access-deny = ( "~", ".inc" )

The second entry, causing the issue, is a duplicate:
url.access-deny = ("")

Resolution

Identify the Duplicate Entry: Inspect the lighttpd configuration file (/opt/vmware/etc/lighttpd/lighttpd.conf) for the url.access-deny directive:
cat  /opt/vmware/etc/lighttpd/lighttpd.conf | grep url.access-deny

Locate the duplicate entry: url.access-deny = ("")

Remove or Comment Out the Duplicate: Modify the lighttpd configuration file by either removing the duplicate entry or commenting out the duplicate entry using a '#' symbol.

Restart the vami-lighttpd Service: systemctl start vami-lighttp

Verify Service Status: systemctl status vami-lighttp

Ensure that the service is active and running.
Loaded: loaded (/etc/init.d/vami-lighttp; enabled; vendor preset: enabled)
Active: active (running)

Additional Information

See https://www.stigviewer.com/stig/vmware_vsphere_6.7_vami-lighttpd/2022-01-03/finding/V-239728
 

At the command prompt, execute the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf|grep "url.access-deny" Expected result: url.access-deny = ("~", ".inc") If the output does not match the expected result, this is a finding.

Navigate to and open /opt/vmware/etc/lighttpd/lighttpd.conf. Add or reconfigure the following value: url.access-deny = ( "~", ".inc" )