STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 31 Oct 2023:

The vCenter Server must enable FIPS-validated cryptography.

DISA Rule

SV-258917r934409_rule

Vulnerability Number

V-258917

Group Title

SRG-APP-000172

Rule Version

VCSA-80-000077

Severity

CAT I

CCI(s)

• CCI-000197 - For password-based authentication, transmit passwords only cryptographically-protected channels.
• CCI-000803 - Implement mechanisms for authentication to a cryptographic module that meet the requirements of applicable laws, Executive Orders, directives, policies, regulations, standards, and guidance for such authentication.
• CCI-001188 - Generate a unique session identifier for each session with organization-defined randomness requirements.
• CCI-001199 - Protects the confidentiality and/or integrity of organization-defined information at rest.
• CCI-001967 - Authenticate organization-defined devices and/or types of devices before establishing a local, remote, and/or network connection using bidirectional authentication that is cryptographically based.
• CCI-002450 - Implement organization-defined types of cryptography for each specified cryptography use.
• CCI-003123 - Implement organization-defined cryptographic mechanisms to protect the confidentiality of nonlocal maintenance and diagnostic communications.

Weight

10

Fix Recommendation

From the vSphere Web Client go to Developer Center >> API Explorer.

From the "Select API" drop-down menu, select appliance.

Expand system/security/global_fips >> PUT.

In the response body under "Try it out" paste the following:

{
"enabled": true
}

Click "Execute".

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

$spec = Initialize-SystemSecurityGlobalFipsUpdateSpec -Enabled $true; Invoke-SetSystemGlobalFips -SystemSecurityGlobalFipsUpdateSpec $spec

Note: The vCenter server reboots after FIPS is enabled or disabled.

Check Contents

From the vSphere Web Client, go to Developer Center >> API Explorer.

From the "Select API" drop-down menu, select appliance.

Expand system/security/global_fips >> GET.

Click "Execute" and then "Copy Response" to view the results.

Example response:

{
"enabled": true
}

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

Invoke-GetSystemGlobalFips

If global FIPS mode is not enabled, this is a finding.

Vulnerability Number

V-258917

Documentable

False

Rule Version

VCSA-80-000077

Severity Override Guidance

From the vSphere Web Client, go to Developer Center >> API Explorer.

From the "Select API" drop-down menu, select appliance.

Expand system/security/global_fips >> GET.

Click "Execute" and then "Copy Response" to view the results.

Example response:

{
"enabled": true
}

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

Invoke-GetSystemGlobalFips

If global FIPS mode is not enabled, this is a finding.

Check Content Reference

M

Target Key

5573