VMware vSphere 6.7 vCenter Security Technical Implementation Guide

The VMware vSphere 6.7 vCenter Security Technical Implementation Guide (V1 R4) has 62 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

62STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R4

CurrentPublished Wed Jul 26 2023 What changed in V1R4

The vCenter Server must implement Active Directory authentication.

VMware vSphere 6.7 vCenter Security Technical Implementation Guide

Assessment Title

Rule Text

The vCenter Server must implement Active Directory authentication.

Description

Discussion Text

The vCenter Server must ensure users are authenticated with an individual authenticator prior to using a group authenticator. Using Active Directory for authentication provides more robust account management capabilities.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-243079

Rule

SV-243079r879594_rule

Severity

medium

Rule Version

VCTR-67-000009

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

From the vSphere Web Client, go to Administration >> Single Sign-On >> Configuration. 

Click the "Identity Sources" tab.

If there is no identity source of type "Active Directory", this is a finding.

Implementation Procedure

Fix Text

From the vSphere Web Client go to Administration >> Single Sign-On >> Configuration. 

Click the "Add identity source".

Select either "Active Directory over LDAP" or "Active Directory" and configure appropriately. 

Note: Windows Integrated Authentication requires that the vCenter server be joined to AD before configuration via Administration >> Single Sign-On >> Configuration >> Active Directory Domain.

STIG check 8 of 62 in the VMware vSphere 6.7 vCenter STIG checklist

← Previous · V-243078The vCenter Server must provide an immediate real-time alert to the SA and ISSO, at a minimum, of all audit failure events.Next · V-243080 →The vCenter Server must limit the use of the built-in SSO administrative account.