VAMI must implement Transport Layer Security (TLS) 1.2 exclusively.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-256668	VCLD-70-000024	SV-256668r888526_rule		Medium

Description
TLS is a required transmission protocol for a web server hosting controlled information. The use of TLS provides confidentiality of data in transit between the web server and client. FIPS 140-2 approved TLS versions must be enabled, and non-FIPS-approved Secure Sockets Layer (SSL) versions must be disabled. VAMI comes configured to use only TLS 1.2. This configuration must be verified and maintained. Satisfies: SRG-APP-000439-WSR-000156, SRG-APP-000442-WSR-000182

Description

TLS is a required transmission protocol for a web server hosting controlled information. The use of TLS provides confidentiality of data in transit between the web server and client. FIPS 140-2 approved TLS versions must be enabled, and non-FIPS-approved Secure Sockets Layer (SSL) versions must be disabled. VAMI comes configured to use only TLS 1.2. This configuration must be verified and maintained. Satisfies: SRG-APP-000439-WSR-000156, SRG-APP-000442-WSR-000182

STIG	Date
VMware vSphere 7.0 VAMI Security Technical Implementation Guide	2023-02-22

Details

Check Text ( C-60343r888524_chk )
At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2>/dev/null\|grep "ssl.use"\|sed 's: ::g' Expected result: ssl.use-sslv2="disable" ssl.use-sslv3="disable" ssl.use-tlsv10="disable" ssl.use-tlsv11="disable" ssl.use-tlsv12="enable" If the output does not match the expected result, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

Check Text ( C-60343r888524_chk )

At the command prompt, run the following command:

# /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2>/dev/null|grep "ssl.use"|sed 's: ::g'

Expected result:

ssl.use-sslv2="disable"
ssl.use-sslv3="disable"
ssl.use-tlsv10="disable"
ssl.use-tlsv11="disable"
ssl.use-tlsv12="enable"

If the output does not match the expected result, this is a finding.

Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details:

https://kb.vmware.com/s/article/2100508

Fix Text (F-60286r888525_fix)
Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf Replace all "ssl.use-*" lines with the following: ssl.use-sslv2="disable" ssl.use-sslv3="disable" ssl.use-tlsv10="disable" ssl.use-tlsv11="disable" ssl.use-tlsv12="enable" Restart the service with the following command: # vmon-cli --restart applmgmt