STIGQter STIGQter: STIG Summary: VMware vSphere 7.0 vCenter Security Technical Implementation Guide Version: 1 Release: 3 Benchmark Date: 24 Jan 2024:

The vCenter Server must use secure Lightweight Directory Access Protocol (LDAPS) when adding an LDAP identity source.

DISA Rule

SV-256368r885715_rule

Vulnerability Number

V-256368

Group Title

SRG-APP-000516

Rule Version

VCSA-70-000288

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

From the vSphere Client, go to Administration >> Single Sign On >> Configuration >> Identity Provider.

Click the "Identity Sources" tab.

For each identity source of type "Active Directory over LDAP" where LDAPS is not configured, highlight the item and click "Edit".

Ensure the primary and secondary server URLs, if specified, are configured for "ldaps://".

At the bottom, click the "Browse" button, select the AD LDAP cert previously exported to the local computer, click "Open", and "Save" to complete modifications.

Note: With LDAPS, the server must be a specific domain controller and its specific certificate or the domain alias with a certificate that is valid for that URL.

Check Contents

If LDAP is not used as an identity provider, this is not applicable.

From the vSphere Client, go to Administration >> Single Sign On >> Configuration >> Identity Provider.

Click the "Identity Sources" tab.

For each identity source of type "Active Directory over LDAP", if the "Server URL" does not indicate "ldaps://", this is a finding.

Vulnerability Number

V-256368

Documentable

False

Rule Version

VCSA-70-000288

Severity Override Guidance

If LDAP is not used as an identity provider, this is not applicable.

From the vSphere Client, go to Administration >> Single Sign On >> Configuration >> Identity Provider.

Click the "Identity Sources" tab.

For each identity source of type "Active Directory over LDAP", if the "Server URL" does not indicate "ldaps://", this is a finding.

Check Content Reference

M

Target Key

5517