The vCenter server must require authentication for published content libraries.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-258961	VCSA-80-000295	SV-258961r961863_rule		Medium

Description
In the vSphere Client, you can create a local or a subscribed content library. By using content libraries, you can store and manage content in one vCenter Server instance. Alternatively, you can distribute content across vCenter Server instances to increase consistency and facilitate the deployment workloads at scale. When publishing a content library it can be protected by requiring authentication for subscribers.

Description

In the vSphere Client, you can create a local or a subscribed content library. By using content libraries, you can store and manage content in one vCenter Server instance. Alternatively, you can distribute content across vCenter Server instances to increase consistency and facilitate the deployment workloads at scale. When publishing a content library it can be protected by requiring authentication for subscribers.

STIG	Date
VMware vSphere 8.0 vCenter Security Technical Implementation Guide	2024-07-11

Details

Check Text ( C-62701r934539_chk )
From the vSphere Client, go to Content Libraries. Review the "Password Protected" column. If a content library is published and is not password protected, this is a finding.

Fix Text (F-62610r934540_fix)
From the vSphere Client, go to Content Libraries. Select the target content library. Select "Actions" then "Edit Settings". Click the checkbox to "Enable user authentication for access to this content library". Enter and confirm a password for the content library. Click "OK". Note: Any subscribed content libraries will need to be updated to enable authentication and provide the password.