STIGQter STIGQter: STIG Summary: VMW vSphere 6.5 vCenter Server for Windows Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

The vCenter Server for Windows must enable revocation checking for certificate based authentication.

DISA Rule

SV-216879r612237_rule

Vulnerability Number

V-216879

Group Title

SRG-APP-000516

Rule Version

VCWN-65-000060

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

1. Login to the Platform Services Controller web interface with administrator@vsphere.local from

https://<FQDN or IP of PSC>/psc

In an embedded deployment the Platform Services Controller host name or IP address is the same as the vCenter Server host name or IP address.

If you specified a different SSO domain during installation, log in as administrator@<mydomain>.

2. Browse to Single Sign-On > Configuration.

3. Click the "Smart Card Configuration" tab

4. Click the "Certificate Revocation Settings" tab

5. Click the "Enable Revocation Check" button

By default the PSC will use the CRL from the certificate to check revocation check status. OCSP with CRL fallback is recommended but this setting is site specific and should be configured appropriately.

Check Contents

1. Login to the Platform Services Controller web interface with administrator@vsphere.local from

https://<FQDN or IP of PSC>/psc

In an embedded deployment the Platform Services Controller host name or IP address is the same as the vCenter Server host name or IP address.

If you specified a different SSO domain during installation, log in as administrator@<mydomain>.

2. Browse to Single Sign-On > Configuration.

3. Click the "Smart Card Configuration" tab

4. Click the "Certificate Revocation Settings" tab

If "Revocation Check" does not show as enabled, this is a finding.

Vulnerability Number

V-216879

Documentable

False

Rule Version

VCWN-65-000060

Severity Override Guidance

1. Login to the Platform Services Controller web interface with administrator@vsphere.local from

https://<FQDN or IP of PSC>/psc

In an embedded deployment the Platform Services Controller host name or IP address is the same as the vCenter Server host name or IP address.

If you specified a different SSO domain during installation, log in as administrator@<mydomain>.

2. Browse to Single Sign-On > Configuration.

3. Click the "Smart Card Configuration" tab

4. Click the "Certificate Revocation Settings" tab

If "Revocation Check" does not show as enabled, this is a finding.

Check Content Reference

M

Target Key

4030

Comments