STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 31 Oct 2023:

The vCenter Server user roles must be verified.

DISA Rule

SV-258921r934421_rule

Vulnerability Number

V-258921

Group Title

SRG-APP-000211

Rule Version

VCSA-80-000095

Severity

CAT II

CCI(s)

• CCI-001082 - Separate user functionality, including user interface services, from system management functionality.
• CCI-001084 - Isolate security functions from nonsecurity functions.
• CCI-001813 - Enforce access restrictions using organization-defined mechanisms.

Weight

10

Fix Recommendation

To update a user's or group's permissions to an existing role with reduced permissions, do the following:

From the vSphere Client, go to Administration >> Access Control >> Global Permissions.

Select the user or group, click the pencil button, change the assigned role, and click "OK".

Note: If permissions are assigned on a specific object, the role must be updated where it is assigned (for example, at the cluster level).

To create a new role with reduced permissions, do the following:

From the vSphere Client, go to Administration >> Access Control >> Roles.

Click the green plus sign and enter a name for the role and select only the specific permissions required.

Users can then be assigned to the newly created role.

Check Contents

From the vSphere Client, go to Administration >> Access Control >> Roles.

View each role and verify the users and/or groups assigned to it by clicking on "Usage".

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

Get-VIPermission | Sort Role | Select Role,Principal,Entity,Propagate,IsGroup | FT -Auto

Application service account and user required privileges should be documented.

If any user or service account has more privileges than required, this is a finding.

Vulnerability Number

V-258921

Documentable

False

Rule Version

VCSA-80-000095

Severity Override Guidance

From the vSphere Client, go to Administration >> Access Control >> Roles.

View each role and verify the users and/or groups assigned to it by clicking on "Usage".

or

From a PowerCLI command prompt while connected to the vCenter server, run the following command:

Get-VIPermission | Sort Role | Select Role,Principal,Entity,Propagate,IsGroup | FT -Auto

Application service account and user required privileges should be documented.

If any user or service account has more privileges than required, this is a finding.

Check Content Reference

M

Target Key

5573