VMware vSphere 6.7 vCenter Security Technical Implementation Guide

The VMware vSphere 6.7 vCenter Security Technical Implementation Guide (V1 R4) has 62 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

62STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R4

CurrentPublished Wed Jul 26 2023

The vCenter Server must enable revocation checking for certificate-based authentication.

VMware vSphere 6.7 vCenter Security Technical Implementation Guide

Assessment Title

Rule Text

The vCenter Server must enable revocation checking for certificate-based authentication.

Description

Discussion Text

The system must establish the validity of the user-supplied identity certificate using OCSP and/or CRL revocation checking.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-243115

Rule

SV-243115r879887_rule

Severity

medium

Rule Version

VCTR-67-000060

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

From the vSphere Client, go to Administration >> Single Sign-On >> Configuration >> Smart Card Authentication. 

Under Smart card authentication settings >> Certificate revocation, verify that "Revocation check" does not show as disabled.

If "Revocation check" shows as disabled, this is a finding.

Implementation Procedure

Fix Text

From the vSphere Client, go to Administration >> Single Sign-On > Configuration >> Smart Card Authentication. 

Under Smart card authentication settings >> Certificate revocation, click the "Edit" button.

By default, the PSC will use the CRL from the certificate to check revocation check status. 

OCSP with CRL fallback is recommended, but this setting is site specific and should be configured appropriately.

STIG check 43 of 62 in the VMware vSphere 6.7 vCenter STIG checklist

← Previous · V-243114The vCenter Server must enable certificate based authentication.Next · V-243116 →The vCenter Server must disable Password and Windows integrated authentication.