VMware vSphere ESXi 6.0 Security Technical Implementation Guide

The VMware vSphere ESXi 6.0 Security Technical Implementation Guide (V1 R5) has 108 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

108STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R5

CurrentPublished Fri Jan 25 2019

The SSH daemon must be configured to only use FIPS 140-2 approved ciphers.

VMware vSphere ESXi 6.0 Security Technical Implementation Guide

Assessment Title

Rule Text

The SSH daemon must be configured to only use FIPS 140-2 approved ciphers.

Description

Discussion Text

Approved algorithms should impart some level of confidence in their implementation. These are also required for compliance.

Note: That this does not imply FIPS 140-2 certification.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-63501

Rule

SV-77991r2_rule

Severity

medium

Rule Version

ESXI-06-100010

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Only FIPS-approved ciphers should be used. To verify that only FIPS-approved ciphers are in use, run the following command: 

# grep -i "^Ciphers" /etc/ssh/sshd_config

If there is no output or the output is not exactly "Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc", this is a finding.

Implementation Procedure

Fix Text

Limit the ciphers to those algorithms which are FIPS-approved. Counter (CTR) mode is also preferred over cipher-block chaining (CBC) mode. 

Add or correct the following line in "/etc/ssh/sshd_config": 

Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,aes192-cbc,aes256-cbc

STIG check 75 of 108 in the VMware vSphere ESXi 6.0 STIG checklist

← Previous · V-63485The VMM must retain the Standard Mandatory DoD Notice and Consent Banner on the screen until users acknowledge the usage conditions and take explicit actions to log on for further access.Next · V-63509 →The VMM must allow only the ISSM (or individuals or roles appointed by the ISSM) to select which auditable events are to be audited.