STIGQter STIGQter: STIG Summary: VMware vRealize Automation 7.x SLES Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Sep 2018:

The SLES for vRealize must enforce SSHv2 for network access to privileged accounts.

DISA Rule

SV-100345r1_rule

Vulnerability Number

V-89695

Group Title

SRG-OS-000112-GPOS-00057

Rule Version

VRAU-SL-000710

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

Configure the SLES for vRealize to enforce SSHv2 for network access to privileged accounts by running the following commands:

# sed -i 's/^.*\bProtocol\b.*$/Protocol 2/' /etc/ssh/sshd_config

Restart the ssh service:

# service sshd restart

Check Contents

Verify that the SLES for vRealize enforces SSHv2 for network access to privileged accounts by running the following command:

Replace [ADDRESS] in the following command with the correct IP address based on the current system configuration.
# ssh -1 [ADDRESS]

An example of the command usage is as follows:
# ssh -1 localhost

The output must be the following:

Protocol major versions differ: 1 vs. 2

If the output is not as listed above, this is a finding.

OR

Verify that the ssh is configured to enforce SSHv2 for network access to privileged accounts by running the following command:

# grep Protocol /etc/ssh/sshd_config

If the result is not "Protocol 2", this is a finding.

Vulnerability Number

V-89695

Documentable

False

Rule Version

VRAU-SL-000710

Severity Override Guidance

Verify that the SLES for vRealize enforces SSHv2 for network access to privileged accounts by running the following command:

Replace [ADDRESS] in the following command with the correct IP address based on the current system configuration.
# ssh -1 [ADDRESS]

An example of the command usage is as follows:
# ssh -1 localhost

The output must be the following:

Protocol major versions differ: 1 vs. 2

If the output is not as listed above, this is a finding.

OR

Verify that the ssh is configured to enforce SSHv2 for network access to privileged accounts by running the following command:

# grep Protocol /etc/ssh/sshd_config

If the result is not "Protocol 2", this is a finding.

Check Content Reference

M

Target Key

3459

Comments