VMware vSphere 6.7 RhttpProxy Security Technical Implementation Guide

The VMware vSphere 6.7 RhttpProxy Security Technical Implementation Guide (V1 R3) has 10 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

10STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R3

CurrentPublished Wed Jul 26 2023

The rhttpproxy must be configured to operate solely with FIPS ciphers.

VMware vSphere 6.7 RhttpProxy Security Technical Implementation Guide

Assessment Title

Rule Text

The rhttpproxy must be configured to operate solely with FIPS ciphers.

Description

Discussion Text

The rhttpproxy ships with FIPS 140-2 validated OpenSSL cryptographic libraries and is configured by default to run in FIPS mode. This module is used for all crypto operations performed by rhttproxy, including protection of data-in-transit over the client TLS connection.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-240718

Rule

SV-240718r879519_rule

Severity

medium

Rule Version

VCRP-67-000003

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

At the command prompt, execute the following command:

# xmllint --xpath '/config/vmacore/ssl/fips' /etc/vmware-rhttpproxy/config.xml

Expected result:

<fips>true</fips>

If the output does not match the expected result, this is a finding.

Implementation Procedure

Fix Text

Navigate to and open /etc/vmware-rhttpproxy/config.xml.

Locate the <config>/<vmacore>/<ssl> block and configure <fips> as follows:

<fips>true</fips>

Restart the service for changes to take effect.

# vmon-cli --restart rhttpproxy

STIG check 3 of 10 in the VMware vSphere 6.7 RhttpProxy STIG checklist

← Previous · V-240717The rhttpproxy must set a limit on established connections.Next · V-240719 →The rhttpproxy must use cryptography to protect the integrity of remote sessions.