STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 31 Oct 2023:

The vCenter Server must enable revocation checking for certificate-based authentication.

DISA Rule

SV-258919r934415_rule

Vulnerability Number

V-258919

Group Title

SRG-APP-000175

Rule Version

VCSA-80-000080

Severity

CAT II

CCI(s)

• CCI-000185 - For public key-based authentication, validate certificates by constructing and verifying a certification path to an accepted trust anchor including checking certificate status information.
• CCI-001954 - Electronically verifies Personal Identity Verification-compliant credentials.
• CCI-002010 - Electronically verify Personal Identity Verification-compliant credentials from other federal agencies.

Weight

10

Fix Recommendation

From the vSphere Client, go to Administration >> Single Sign On >> Configuration >> Identity Provider >> Smart Card Authentication.

Under Smart card authentication settings >> Certificate revocation, click the "Edit" button.

Configure revocation checking per site requirements. OCSP with CRL failover is recommended.

Note: If FIPS mode is enabled on vCenter, OCSP revocation validation may not function and CRL bay be used instead.

By default, both locations are pulled from the cert. CRL location can be overridden in this screen, and local responders can be specified via the sso-config command line tool. See the vSphere documentation for more information.

Check Contents

If a federated identity provider is configured and used for an identity source and supports Smartcard authentication, this is not applicable.

From the vSphere Client, go to Administration >> Single Sign On >> Configuration >> Identity Provider >> Smart Card Authentication.

Under Smart card authentication settings >> Certificate revocation, verify "Revocation check" does not show as disabled.

If "Revocation check" shows as disabled, this is a finding.

Vulnerability Number

V-258919

Documentable

False

Rule Version

VCSA-80-000080

Severity Override Guidance

If a federated identity provider is configured and used for an identity source and supports Smartcard authentication, this is not applicable.

From the vSphere Client, go to Administration >> Single Sign On >> Configuration >> Identity Provider >> Smart Card Authentication.

Under Smart card authentication settings >> Certificate revocation, verify "Revocation check" does not show as disabled.

If "Revocation check" shows as disabled, this is a finding.

Check Content Reference

M

Target Key

5573