VMware vSphere ESXi 6.0 Security Technical Implementation Guide

The VMware vSphere ESXi 6.0 Security Technical Implementation Guide (V1 R5) has 108 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

108STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R5

CurrentPublished Fri Jan 25 2019

The VMM must use DoD-approved encryption to protect the confidentiality of remote access sessions.

VMware vSphere ESXi 6.0 Security Technical Implementation Guide

Assessment Title

Rule Text

The VMM must use DoD-approved encryption to protect the confidentiality of remote access sessions.

Description

Discussion Text

Approved algorithms should impart some level of confidence in their implementation. These are also required for compliance.

Note: This does not imply FIPS 140-2 certification.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-63189

Rule

SV-77679r3_rule

Severity

medium

Rule Version

ESXI-06-000010

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Only FIPS-approved ciphers should be used. To verify that only FIPS-approved ciphers are in use, run the following command: 

# grep -i "^Ciphers" /etc/ssh/sshd_config

If there is no output or the output is not "Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc", or a subset of this list, this is a finding.

Implementation Procedure

Fix Text

Limit the ciphers to those algorithms which are FIPS-approved. Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode. 

Add or correct the following line in "/etc/ssh/sshd_config": 

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc

STIG check 10 of 108 in the VMware vSphere ESXi 6.0 STIG checklist

← Previous · V-63187The SSH daemon must be configured with the Department of Defense (DoD) login banner.Next · V-63191 →The SSH daemon must be configured to use only the SSHv2 protocol.