The Update Manager must not directly connect to public patch repositories on the Internet.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-39569	VCENTER-000034	SV-51427r1_rule		Medium

Description
In a typical deployment, the Update Manager connects to public patch repositories on the Internet to download patches. Any channel to the Internet represents a threat. For security reasons and deployment restrictions, the Update Manager must be installed in a secured network that is disconnected from the Internet.

STIG	Date
VMware vCenter Server Version 5 Security Technical Implementation Guide	2014-11-10

Details

Check Text ( C-46794r1_chk )
Verify the Update Manager download source is not the Internet. To verify download settings, from the vSphere Client/vCenter Server system, click Update Manager under Solutions and Applications. On the Configuration tab, under Settings, click Download Settings. In the Download Sources pane, verify "Direct connection to Internet" is not selected. If "Direct connection to Internet" is configured, this is a finding.

Check Text ( C-46794r1_chk )

Verify the Update Manager download source is not the Internet.

To verify download settings, from the vSphere Client/vCenter Server system, click Update Manager under Solutions and Applications.

On the Configuration tab, under Settings, click Download Settings. In the Download Sources pane, verify "Direct connection to Internet" is not selected.

If "Direct connection to Internet" is configured, this is a finding.

Fix Text (F-44582r2_fix)
To configure a Web server or local disk repository as a download source (i.e., "Direct connection to Internet" must not be selected as the source), from the vSphere Client/vCenter Server system, click Update Manager under Solutions and Applications. On the Configuration tab, under Settings, click Download Settings. In the Download Sources pane, select Use a shared repository. Enter the path or the URL to the shared repository. Click Validate URL to validate the path. Click Apply.

Fix Text (F-44582r2_fix)

To configure a Web server or local disk repository as a download source (i.e., "Direct connection to Internet" must not be selected as the source), from the vSphere Client/vCenter Server system, click Update Manager under Solutions and Applications. On the Configuration tab, under Settings, click Download Settings. In the Download Sources pane, select Use a shared repository. Enter the path or the URL to the shared repository. Click Validate URL to validate the path. Click Apply.