STIGQter: STIG Summary: VMware vSphere 7.0 vCenter Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Jan 2024:

The vCenter server must enforce SNMPv3 security features where SNMP is required.

DISA Rule

SV-256344r885643_rule

Vulnerability Number

V-256344

Group Title

SRG-APP-000575

Rule Version

VCSA-70-000253

Severity

CAT II

CCI(s)

CCI-001967 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.

Weight

Fix Recommendation

At the command prompt on the vCenter Server Appliance, run the following commands:

# appliancesh
# snmp.set --authentication SHA1
# snmp.set --privacy AES128

To change the security level of a user, run the following command:

# snmp.set --users <username>/<auth_password> <priv_password>/priv

Check Contents

At the command prompt on the vCenter Server Appliance, run the following commands:

# appliancesh
# snmp.get

Note: The "appliancesh" command is not needed if the default shell has not been changed for root.

If "Enable" is set to "False", this is not a finding.

If "Enable" is set to "True" and "Authentication" is not set to "SHA1", this is a finding.

If "Enable" is set to "True" and "Privacy" is not set to "AES128", this is a finding.

If any "Users" are configured with a "Sec_level" that does not equal "priv", this is a finding.

Vulnerability Number

V-256344

Documentable

False

Rule Version

VCSA-70-000253

Severity Override Guidance

Check Content Reference

Target Key

5517