STIGQter: STIG Summary: VMware vSphere 7.0 vCenter Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Jan 2024:

The vCenter Server must require multifactor authentication.

DISA Rule

SV-256324r885583_rule

Vulnerability Number

V-256324

Group Title

SRG-APP-000149

Rule Version

VCSA-70-000060

Severity

CAT II

CCI(s)

• CCI-000166 - Provide irrefutable evidence that an individual (or process acting on behalf of an individual) falsely denying having performed organization-defined actions to be covered by non-repudiation.
• CCI-000765 - Implement multifactor authentication for network access to privileged accounts.
• CCI-000766 - Implement multifactor authentication for network access to non-privileged accounts.
• CCI-001953 - Accepts Personal Identity Verification-compliant credentials.
• CCI-002009 - Accept Personal Identity Verification-compliant credentials from other federal agencies.

Weight

10

Fix Recommendation

To configure smart card authentication for vCenter when using the embedded identity provider, refer to the supplemental document. 

For vCenter Servers using a third-party identity provider, consult the product's documentation for enabling multifactor authentication.

Check Contents

From the vSphere Web Client, go to Administration >> Single Sign On >> Configuration >> Identity Provider.

If the embedded identity provider is used, click on "Smart Card Authentication".

If the embedded identity provider is used and "Smart Card Authentication" is not enabled, this is a finding.

If a third-party identity provider is used, such as Microsoft ADFS, and it does not require multifactor authentication to log on to vCenter, this is a finding.

Vulnerability Number

V-256324

Documentable

False

Rule Version

VCSA-70-000060

Severity Override Guidance

From the vSphere Web Client, go to Administration >> Single Sign On >> Configuration >> Identity Provider.

If the embedded identity provider is used, click on "Smart Card Authentication".

If the embedded identity provider is used and "Smart Card Authentication" is not enabled, this is a finding.

If a third-party identity provider is used, such as Microsoft ADFS, and it does not require multifactor authentication to log on to vCenter, this is a finding.

Check Content Reference

M

Target Key

5517