STIGQter: STIG Summary: VMware vSphere 6.7 ESXi Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 09 Mar 2021:

The ESXi host must use multifactor authentication for local DCUI access to privileged accounts.

DISA Rule

SV-239295r674814_rule

Vulnerability Number

V-239295

Group Title

SRG-OS-000107-VMM-000530

Rule Version

ESXI-67-000040

Severity

CAT III

CCI(s)

• CCI-000767 - The information system implements multifactor authentication for local access to privileged accounts.
• CCI-001953 - The information system accepts Personal Identity Verification (PIV) credentials.
• CCI-001954 - The information system electronically verifies Personal Identity Verification (PIV) credentials.
• CCI-002470 - The information system only allows the use of organization-defined certificate authorities for verification of the establishment of protected sessions.

Weight

10

Fix Recommendation

The following are prerequisites to configuration of smart card authentication for the ESXi DCUI:

- Active Directory domain that supports smart card authentication, smart card readers, and smart cards;
- ESXi joined to an Active Directory domain; and
- Trusted certificates for root and intermediary certificate authorities.

From the vSphere Client, select the ESXi host and go to Configure >> System >> Authentication Services, click "Edit", and check the "Enable Smart Card Authentication" checkbox.

At the "Certificates" tab, click the green plus sign to import trusted certificate authority certificates and click "OK".

Check Contents

From the vSphere Client, select the ESXi Host and go to Configure >> System >> Authentication Services and view the Smart Card Authentication status.

If "Smart Card Mode" is "Disabled", this is a finding.

For environments that do have PKI or AD available, this is Not Applicable.

Vulnerability Number

V-239295

Documentable

False

Rule Version

ESXI-67-000040

Severity Override Guidance

From the vSphere Client, select the ESXi Host and go to Configure >> System >> Authentication Services and view the Smart Card Authentication status.

If "Smart Card Mode" is "Disabled", this is a finding.

For environments that do have PKI or AD available, this is Not Applicable.

Check Content Reference

M

Target Key

5326

Comments