Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-256668 | VCLD-70-000024 | SV-256668r888526_rule | Medium |
Description |
---|
TLS is a required transmission protocol for a web server hosting controlled information. The use of TLS provides confidentiality of data in transit between the web server and client. FIPS 140-2 approved TLS versions must be enabled, and non-FIPS-approved Secure Sockets Layer (SSL) versions must be disabled. VAMI comes configured to use only TLS 1.2. This configuration must be verified and maintained. Satisfies: SRG-APP-000439-WSR-000156, SRG-APP-000442-WSR-000182 |
STIG | Date |
---|---|
VMware vSphere 7.0 VAMI Security Technical Implementation Guide | 2023-06-15 |
Check Text ( C-60343r888524_chk ) |
---|
At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2>/dev/null|grep "ssl.use"|sed 's: ::g' Expected result: ssl.use-sslv2="disable" ssl.use-sslv3="disable" ssl.use-tlsv10="disable" ssl.use-tlsv11="disable" ssl.use-tlsv12="enable" If the output does not match the expected result, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508 |
Fix Text (F-60286r888525_fix) |
---|
Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf Replace all "ssl.use-*" lines with the following: ssl.use-sslv2="disable" ssl.use-sslv3="disable" ssl.use-tlsv10="disable" ssl.use-tlsv11="disable" ssl.use-tlsv12="enable" Restart the service with the following command: # vmon-cli --restart applmgmt |