The vCenter Envoy service must set a limit on remote connections.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-259165	VCRP-80-000098	SV-259165r935399_rule		Medium

Description
Envoy client connections must be limited to preserve system resources and continue servicing connections without interruption. Without a limit set, the system would be vulnerable to a trivial denial-of-service attack where connections are created en masse and vCenter resources are entirely consumed. Envoy comes hard coded with a tested and supported value for "maxRemoteHttpsConnections" and "maxRemoteHttpConnections" that must be verified and maintained.

Description

Envoy client connections must be limited to preserve system resources and continue servicing connections without interruption. Without a limit set, the system would be vulnerable to a trivial denial-of-service attack where connections are created en masse and vCenter resources are entirely consumed. Envoy comes hard coded with a tested and supported value for "maxRemoteHttpsConnections" and "maxRemoteHttpConnections" that must be verified and maintained.

STIG	Date
VMware vSphere 8.0 vCenter Appliance Envoy Security Technical Implementation Guide	2023-10-29

Details

Check Text ( C-62905r935397_chk )
At the command prompt, run the following commands: # xmllint --xpath '/config/envoy/L4Filter/maxRemoteHttpsConnections/text()' /etc/vmware-rhttpproxy/config.xml # xmllint --xpath '/config/envoy/L4Filter/maxRemoteHttpConnections/text()' /etc/vmware-rhttpproxy/config.xml Example result: 2048 or XPath set is empty If the output is not "2048" or "XPath set it empty", this is a finding. Note: If "XPath set is empty" is returned the default values are in effect and is 2048.

Check Text ( C-62905r935397_chk )

At the command prompt, run the following commands:

# xmllint --xpath '/config/envoy/L4Filter/maxRemoteHttpsConnections/text()' /etc/vmware-rhttpproxy/config.xml
# xmllint --xpath '/config/envoy/L4Filter/maxRemoteHttpConnections/text()' /etc/vmware-rhttpproxy/config.xml

Example result:

2048

or

XPath set is empty

If the output is not "2048" or "XPath set it empty", this is a finding.

Note: If "XPath set is empty" is returned the default values are in effect and is 2048.

Fix Text (F-62814r935398_fix)
Navigate to and open: /etc/vmware-rhttpproxy/config.xml Locate the // block and configure it as follows: 2048 2048 Restart the service for changes to take effect. # vmon-cli --restart rhttpproxy