A least-privileges assignment must be used for the vCenter Server database user.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-39561	VCENTER-000023	SV-51419r1_rule		Medium

Description
Least-privileges mitigates attacks if the vCenter database account is compromised. vCenter requires very specific privileges on the database. Privileges normally required only for installation and upgrade must be removed for/during normal operation. These privileges may be reinstated if/when any future upgrade must be performed.

STIG	Date
VMware vCenter Server Version 5 Security Technical Implementation Guide	2013-12-18

Details

Check Text ( C-46786r2_chk )
Verify only the runtime privileges needed for the current vCenter state, on either Oracle or Microsoft SQL Server, is assigned. Verify that the following permissions are granted to the vCenter user in the vCenter database. GRANT ALTER ON SCHEMA :: to ; GRANT REFERENCES ON SCHEMA :: to ; GRANT INSERT ON SCHEMA :: to ; GRANT CREATE TABLE to ; GRANT CREATE VIEW to ; GRANT CREATE Procedure to ; For SQL, verify that the following permissions are granted to the user in the MSDB database. Note that the msdb database is used by SQL Server Agent for scheduling alerts and jobs. GRANT SELECT on msdb.dbo.syscategories to ; GRANT SELECT on msdb.dbo.sysjobsteps to ; GRANT SELECT ON msdb.dbo.sysjobs to ; GRANT EXECUTE ON msdb.dbo.sp_add_job TO ; GRANT EXECUTE ON msdb.dbo.sp_delete_job TO ; GRANT EXECUTE ON msdb.dbo.sp_add_jobstep TO ; GRANT EXECUTE ON msdb.dbo.sp_update_job TO ; GRANT EXECUTE ON msdb.dbo.sp_add_category TO ; GRANT EXECUTE ON msdb.dbo.sp_add_jobserver TO ; GRANT EXECUTE ON msdb.dbo.sp_add_jobschedule TO ; For Oracle, verify that the following permissions (or DBA role) are granted to the user. grant connect to grant resource to grant create view to grant create materialized view to grant execute on dbms_job to grant execute on dbms_lock to grant unlimited tablespace to If the runtime privileges are not configured per the above guidelines, this is a finding.

Check Text ( C-46786r2_chk )

Verify only the runtime privileges needed for the current vCenter state, on either Oracle or Microsoft SQL Server, is assigned.

Verify that the following permissions are granted to the vCenter user in the vCenter database.
GRANT ALTER ON SCHEMA :: to ;
GRANT REFERENCES ON SCHEMA :: to ;
GRANT INSERT ON SCHEMA :: to ;
GRANT CREATE TABLE to ;
GRANT CREATE VIEW to ;
GRANT CREATE Procedure to ;

For SQL, verify that the following permissions are granted to the user in the MSDB database. Note that the msdb database is used by SQL Server Agent for scheduling alerts and jobs.
GRANT SELECT on msdb.dbo.syscategories to ;
GRANT SELECT on msdb.dbo.sysjobsteps to ;
GRANT SELECT ON msdb.dbo.sysjobs to ;
GRANT EXECUTE ON msdb.dbo.sp_add_job TO ;
GRANT EXECUTE ON msdb.dbo.sp_delete_job TO ;
GRANT EXECUTE ON msdb.dbo.sp_add_jobstep TO ;
GRANT EXECUTE ON msdb.dbo.sp_update_job TO ;
GRANT EXECUTE ON msdb.dbo.sp_add_category TO ;
GRANT EXECUTE ON msdb.dbo.sp_add_jobserver TO ;
GRANT EXECUTE ON msdb.dbo.sp_add_jobschedule TO ;

For Oracle, verify that the following permissions (or DBA role) are granted to the user.
grant connect to
grant resource to
grant create view to
grant create materialized view to
grant execute on dbms_job to
grant execute on dbms_lock to
grant unlimited tablespace to

If the runtime privileges are not configured per the above guidelines, this is a finding.

Fix Text (F-44574r2_fix)
Set the runtime privileges needed for the current vCenter state, on either Oracle or Microsoft SQL Server as noted below. Grant the following permissions to the vCenter user in the vCenter database: GRANT ALTER ON SCHEMA :: to ; GRANT REFERENCES ON SCHEMA :: to ; GRANT INSERT ON SCHEMA :: to ; GRANT CREATE TABLE to ; GRANT CREATE VIEW to ; GRANT CREATE Procedure to ; Grant the following permissions to the user in the MSDB database. Note that the msdb database is used by SQL Server Agent for scheduling alerts and jobs. GRANT SELECT on msdb.dbo.syscategories to ; GRANT SELECT on msdb.dbo.sysjobsteps to ; GRANT SELECT ON msdb.dbo.sysjobs to ; GRANT EXECUTE ON msdb.dbo.sp_add_job TO ; GRANT EXECUTE ON msdb.dbo.sp_delete_job TO ; GRANT EXECUTE ON msdb.dbo.sp_add_jobstep TO ; GRANT EXECUTE ON msdb.dbo.sp_update_job TO ; GRANT EXECUTE ON msdb.dbo.sp_add_category TO ; GRANT EXECUTE ON msdb.dbo.sp_add_jobserver TO ; GRANT EXECUTE ON msdb.dbo.sp_add_jobschedule TO ; For Oracle, either assign the DBA role or grant the following permissions to the user. grant connect to grant resource to grant create view to grant create materialized view to grant execute on dbms_job to grant execute on dbms_lock to grant unlimited tablespace to

Fix Text (F-44574r2_fix)

Set the runtime privileges needed for the current vCenter state, on either Oracle or Microsoft SQL Server as noted below.

Grant the following permissions to the vCenter user in the vCenter database:
GRANT ALTER ON SCHEMA :: to ;
GRANT REFERENCES ON SCHEMA :: to ;
GRANT INSERT ON SCHEMA :: to ;
GRANT CREATE TABLE to ;
GRANT CREATE VIEW to ;
GRANT CREATE Procedure to ;

Grant the following permissions to the user in the MSDB database. Note that the msdb database is used by SQL Server Agent for scheduling alerts and jobs.
GRANT SELECT on msdb.dbo.syscategories to ;
GRANT SELECT on msdb.dbo.sysjobsteps to ;
GRANT SELECT ON msdb.dbo.sysjobs to ;
GRANT EXECUTE ON msdb.dbo.sp_add_job TO ;
GRANT EXECUTE ON msdb.dbo.sp_delete_job TO ;
GRANT EXECUTE ON msdb.dbo.sp_add_jobstep TO ;
GRANT EXECUTE ON msdb.dbo.sp_update_job TO ;
GRANT EXECUTE ON msdb.dbo.sp_add_category TO ;
GRANT EXECUTE ON msdb.dbo.sp_add_jobserver TO ;
GRANT EXECUTE ON msdb.dbo.sp_add_jobschedule TO ;

For Oracle, either assign the DBA role or grant the following permissions to the user.
grant connect to
grant resource to
grant create view to
grant create materialized view to
grant execute on dbms_job to
grant execute on dbms_lock to
grant unlimited tablespace to