What changed in VMware vSphere 7.0 ESXi STIG V1R5V1R5 changes

Title

The ESXi host must display the Standard Mandatory DODDoW Notice and Consent Banner before granting access to the system via the Direct Console User Interface (DCUI).

Check text

From the vSphere Client, go to Hosts and Clusters. Select the ESXi Host >> Configure >> System >> Advanced System Settings. Select the "Annotations.WelcomeMessage" value and verify it contains the DODDoW logon banner below. or From a PowerCLI command prompt while connected to the ESXi host, run the following command: Get-VMHost | Get-AdvancedSetting -Name Annotations.WelcomeMessage Banner: {bgcolor:black} {/color}{align:left}{bgcolor:black}{color:yellow}{hostname} , {ip}{/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{align:left}{bgcolor:black}{color:yellow}{esxproduct} {esxversion}{/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{align:left}{bgcolor:black}{color:yellow}{memory} RAM{/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{align:left}{bgcolor:black}{color:white} {/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black} {/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black} You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By {/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black} using this IS (which includes any device attached to this IS), you consent to the following conditions: {/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black} {/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black} - The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited {/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black} to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law {/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black} enforcement (LE), and counterintelligence (CI) investigations. {/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black} {/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black} - At any time, the USG may inspect and seize data stored on this IS. {/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black} {/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black} - Communications using, or data stored on, this IS are not private, are subject to routine monitoring, {/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black} interception, and search, and may be disclosed or used for any USG-authorized purpose. {/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black} {/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black} - This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not {/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black} for your personal benefit or privacy. {/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black} {/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black} - Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching {/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black} or monitoring of the content of privileged communications, or work product, related to personal representation {/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black} or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work {/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black} product are private and confidential. See User Agreement for details. {/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{align:left}{bgcolor:yellow}{color:black} {/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black} {/color}{/bgcolor}1n{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black} {/color}{/bgcolor}1n{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black} {/color}{/bgcolor}1n{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black} {/color}{/bgcolor}1n{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black} {/color}{/bgcolor}1n{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black} {/color}{/bgcolor}1n{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black} {/color}{/bgcolor}1n{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black} {/color}{/bgcolor}1n{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black} {/color}{/bgcolor}1n{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black} {/color}{/bgcolor}1n{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black} {/color}{/bgcolor}1n{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black} {/color}{/bgcolor}1n{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black} {/color}{/bgcolor}1n{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black} {/color}{/bgcolor}1n{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black} {/color}{/bgcolor}1n{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black} {/color}{/bgcolor}1n{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black} {/color}{/bgcolor}1n{bgcolor:black} {/color}{align:left}{bgcolor:dark-grey}{color:white} &ltF2> Accept Conditions and Customize System / View Logs{/align}{align:right}&ltF12> Accept Conditions and Shut Down/Restart {bgcolor:black} {/color}{/color}{/bgcolor}{/align}1n{bgcolor:black} {/color}{bgcolor:dark-grey}{color:black} {/color}{/bgcolor} If the "Annotations.WelcomeMessage" setting is not set to the specified banner, this is a finding.

Discussion

Failure to display the DODDoW logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources. Satisfies: SRG-OS-000023-VMM-000060, SRG-OS-000024-VMM-000070

V-256381 in V1R5

Title

The ESXi host must display the Standard Mandatory DODoW Notice and Consent Banner before granting access to the system via Secure Shell (SSH).

Check text

From the vSphere Client, go to Hosts and Clusters. Select the ESXi Host >> Configure >> System >> Advanced System Settings. Select the "Config.Etc.issue" value and verify it is set to the DODDoW logon banner below. or From a PowerCLI command prompt while connected to the ESXi host, run the following command: Get-VMHost | Get-AdvancedSetting -Name Config.Etc.issue If the "Config.Etc.issue" setting (/etc/issue file) does not contain the logon banner exactly as shown below, this is a finding. "You are accessing a U.S. Government (USG) Information System (IS) that is provided for USG-authorized use only. By using this IS (which includes any device attached to this IS), you consent to the following conditions: -The USG routinely intercepts and monitors communications on this IS for purposes including, but not limited to, penetration testing, COMSEC monitoring, network operations and defense, personnel misconduct (PM), law enforcement (LE), and counterintelligence (CI) investigations. -At any time, the USG may inspect and seize data stored on this IS. -Communications using, or data stored on, this IS are not private, are subject to routine monitoring, interception, and search, and may be disclosed or used for any USG-authorized purpose. -This IS includes security measures (e.g., authentication and access controls) to protect USG interests--not for your personal benefit or privacy. -Notwithstanding the above, using this IS does not constitute consent to PM, LE or CI investigative searching or monitoring of the content of privileged communications, or work product, related to personal representation or services by attorneys, psychotherapists, or clergy, and their assistants. Such communications and work product are private and confidential. See User Agreement for details."

Discussion

Failure to display the DODoW logon banner prior to a logon attempt will negate legal proceedings resulting from unauthorized access to system resources.

V-256382 in V1R5

Title

The ESXi host SSH daemon must be configured with the DODoW logon banner.

V-256383 in V1R5

Check text

From the vSphere Client, go to Hosts and Clusters. Select the ESXi Host >> Configure >> System >> Time Configuration. Under "Current Time Configuration", verify "Time Synchronization" is set to "Network Time Protocol". Under "Network Time Protocol", verify the "NTP Servers" are authorized DODDoW time sources. If the ESXi host is not configured to pull time from authoritative DODDoW time sources, this is a finding. or From a PowerCLI command prompt while connected to the ESXi host, run the following commands: Get-VMHost | Get-VMHostNTPServer Get-VMHost | Get-VMHostService | Where {$_.Label -eq "NTP Daemon"} If the NTP service is not configured with authoritative DODDoW time sources or the service does not have a "Policy" of "on" or is stopped, this is a finding.

Fix text

From the vSphere Client, go to Hosts and Clusters. Select the ESXi Host >> Configure >> System >> Time Configuration. Under "Network Time Protocol", click "Edit...". Ensure the "NTP Servers" are authorized DODDoW time sources. Ensure the "NTP Service Startup Policy" is set to "Start and stop with host". Ensure the "Enable" checkbox, in the upper left, is checked. Click "OK". Click "Edit" to configure the NTP service to start and stop with the host and with authoritative DODDoW time sources. or From a PowerCLI command prompt while connected to the ESXi host, run the following commands: $NTPServers = "ntpserver1","ntpserver2" Get-VMHost | Add-VMHostNTPServer $NTPServers Get-VMHost | Get-VMHostService | Where {$_.Label -eq "NTP Daemon"} | Set-VMHostService -Policy On Get-VMHost | Get-VMHostService | Where {$_.Label -eq "NTP Daemon"} | Start-VMHostService

Discussion

To ensure the accuracy of the system clock, it must be synchronized with an authoritative time source within DODDoW. Many system functions, including time-based logon and activity restrictions, automated reports, system logs, and audit records, depend on an accurate system clock. If there is no confidence in the correctness of the system clock, time-based functions may not operate as intended and records may be of diminished value. Satisfies: SRG-OS-000355-VMM-001330, SRG-OS-000356-VMM-001340

V-256409 in V1R5

Title

The ESXi host must use DODoW-approved certificates.

Check text

From the vSphere Client, go to Hosts and Clusters. Select the ESXi Host >> Configure >> System >> Certificate. If the issuer is not a DODDoW-approved certificate authority, or other AO-approved certificate authority, this is a finding. If the host will never be accessed directly (virtual machine console connections bypass vCenter), this is not a finding.

Fix text

Join the ESXi host to vCenter before replacing the certificate. Obtain a DODDoW-issued certificate and private key for the host following the requirements below: Key size: 2048 bits or more (PEM encoded) Key format: PEM VMware supports PKCS8 and PKCS1 (RSA keys) x509 version 3 SubjectAltName must contain DNS Name=&ltmachine_FQDN> CRT (Base-64) format Contains the following Key Usages: Digital Signature, Non Repudiation, Key Encipherment Start time of one day before the current time CN (and SubjectAltName) set to the host name (or IP address) that the ESXi host has in the vCenter Server inventory From the vSphere Web Client, select the ESXi host's vCenter Server >> Configure >> System >> Advanced Settings. Select the "vpxd.certmgmt.mode" value and ensure it is set to "custom". Put the host into maintenance mode. Temporarily enable Secure Shell (SSH) on the host. Use Secure Copy Protocol (SCP) to transfer the new certificate and key to /tmp. SSH to the host. Back up the existing certificate and key: # mv /etc/vmware/ssl/rui.crt /etc/vmware/ssl/rui.crt.bak # mv /etc/vmware/ssl/rui.key /etc/vmware/ssl/rui.key.bak Copy the new certificate and key to "/etc/vmware/ssl/" and rename them to "rui.crt" and "rui.key" respectively. Restart management agents to implement the new certificate: # services.sh restart

Discussion

The default self-signed host certificate issued by the VMware Certificate Authority (VMCA) must be replaced with a DODDoW-approved certificate when the host will be accessed directly, such as during a virtual machine (VM) console connection. The use of a DODDoW certificate on the host assures clients the service they are connecting to is legitimate and properly secured.

V-256431 in V1R5

Check text

From the vSphere Client, go to Hosts and Clusters. Select the ESXi Host >> Configure >> System >> Advanced System Settings. Select the "Security.PasswordMaxDays" value and verify it is set to "90180". or From a PowerCLI command prompt while connected to the ESXi host, run the following command: Get-VMHost | Get-AdvancedSetting -Name Security.PasswordMaxDays If the "Security.PasswordMaxDays" setting is not set to "90180", this is a finding.

Fix text

From the vSphere Client, go to Hosts and Clusters. Select the ESXi Host >> Configure >> System >> Advanced System Settings. Click "Edit". Select the "Security.PasswordMaxDays" value and set it to "90180". or From a PowerCLI command prompt while connected to the ESXi host, run the following command: Get-VMHost | Get-AdvancedSetting -Name Security.PasswordMaxDays | Set-AdvancedSetting -Value "90180"

V-256443 in V1R5