STIGQter: STIG Summary: VMware vSphere 7.0 vCenter Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Jan 2024:

The vCenter Server must configure the vSAN Datastore name to a unique name.

DISA Rule

SV-256362r885697_rule

Vulnerability Number

V-256362

Group Title

SRG-APP-000516

Rule Version

VCSA-70-000282

Severity

CAT II

CCI(s)

• CCI-000366 - Implement the security configuration settings.

Weight

10

Fix Recommendation

From the vSphere Client, go to Host and Clusters.

Select a vSAN Enabled Cluster >> Datastores.

Right-click on the datastore named "vsanDatastore" and select "Rename".

Rename the datastore based on site-specific naming standards.

Click "OK".

or

From a PowerCLI command prompt while connected to the vCenter server, run the following commands:

If($(Get-Cluster | where {$_.VsanEnabled} | Measure).Count -gt 0){
Write-Host "vSAN Enabled Cluster found"
$Clusters = Get-Cluster | where {$_.VsanEnabled}
Foreach ($clus in $clusters){
$clus | Get-Datastore | where {$_.type -match "vsan"} | Set-Datastore -Name $(($clus.name) + "_vSAN_Datastore")
}
}
else{
Write-Host "vSAN is not enabled, this finding is not applicable"
}

Check Contents

If no clusters are enabled for vSAN, this is not applicable.

From the vSphere Client, go to Host and Clusters.

Select a vSAN Enabled Cluster >> Datastores.

Review the datastores and identify any datastores with "vSAN" as the datastore type.

or

From a PowerCLI command prompt while connected to the vCenter server, run the following commands:

If($(Get-Cluster | where {$_.VsanEnabled} | Measure).Count -gt 0){
Write-Host "vSAN Enabled Cluster found"
Get-Cluster | where {$_.VsanEnabled} | Get-Datastore | where {$_.type -match "vsan"}
}
else{
Write-Host "vSAN is not enabled, this finding is not applicable"
}

If vSAN is enabled and a datastore is named "vsanDatastore", this is a finding.

Vulnerability Number

V-256362

Documentable

False

Rule Version

VCSA-70-000282

Severity Override Guidance

If no clusters are enabled for vSAN, this is not applicable.

From the vSphere Client, go to Host and Clusters.

Select a vSAN Enabled Cluster >> Datastores.

Review the datastores and identify any datastores with "vSAN" as the datastore type.

or

From a PowerCLI command prompt while connected to the vCenter server, run the following commands:

If($(Get-Cluster | where {$_.VsanEnabled} | Measure).Count -gt 0){
Write-Host "vSAN Enabled Cluster found"
Get-Cluster | where {$_.VsanEnabled} | Get-Datastore | where {$_.type -match "vsan"}
}
else{
Write-Host "vSAN is not enabled, this finding is not applicable"
}

If vSAN is enabled and a datastore is named "vsanDatastore", this is a finding.

Check Content Reference

M

Target Key

5517