UCF STIG Viewer Logo

The system must alert administrators on permission deletion operations.


Overview

Finding ID Version Rule ID IA Controls Severity
V-64033 VCWN-06-000049 SV-78523r1_rule Medium
Description
If personnel are not notified of permission events, they will not be aware of possible unsecure situations.
STIG Date
VMware vSphere vCenter Server Version 6 Security Technical Implementation Guide 2017-07-11

Details

Check Text ( C-64785r1_chk )
From the vSphere Client select the vCenter server at the top of the hierarchy and go to >> Alarms >> Definitions. Verify there is an alarm created to alert on permission deletions.

or

From a PowerCLI command prompt while connected to the vCenter server run the following command:

Get-AlarmDefinition | Where {$_.ExtensionData.Info.Expression.Expression.EventTypeId -eq "vim.event.PermissionRemovedEvent"} | Select Name,Enabled,@{N="EventTypeId";E={$_.ExtensionData.Info.Expression.Expression.EventTypeId}}

If an alarm is not created to alert on permission deletion events, this is a finding.
Fix Text (F-69963r1_fix)
From the vSphere Client select the vCenter server at the top of the hierarchy and go to >> Alarms >> Definitions >> Right click in the empty space and select New Alarm. On the General tab provide an alarm name and description, Select vCenter for alarm type and "Monitor for specific events occurring on this object", check "Enable this alarm". On the Triggers tab click Add three triggers and in the event column enter "vim.event.PermissionAddedEvent", "vim.event.PermissionRemovedEvent", and "vim.event.PermissionUpdatedEvent" for the three triggers and click OK.