STIGQter: STIG Summary: VMware vSphere 8.0 vCenter Appliance Secure Token Service (STS) Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 31 Oct 2023:

The vCenter STS service must be configured to use strong encryption ciphers.

DISA Rule

SV-258971r934571_rule

Vulnerability Number

V-258971

Group Title

SRG-APP-000014-AS-000009

Rule Version

VCST-80-000002

Severity

CAT II

CCI(s)

CCI-000068 - Implement cryptographic mechanisms to protect the confidentiality of remote access sessions.
CCI-000197 - For password-based authentication, transmit passwords only cryptographically-protected channels.
CCI-001453 - Implement cryptographic mechanisms to protect the integrity of remote access sessions.
CCI-002418 - Protect the confidentiality and/or integrity of transmitted information.

Weight

Fix Recommendation

Navigate to and open:

/usr/lib/vmware-sso/vmware-sts/conf/server.xml

For each connector with "SSLEnabled" set to true, configure the ciphers attribute under the "SSLHostConfig" as follows:

ciphers="TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"

Restart the service with the following command:

# vmon-cli --restart sts

Check Contents

At the command prompt, run the following command:

# xmllint --xpath '/Server/Service/Connector/SSLHostConfig/@ciphers' /usr/lib/vmware-sso/vmware-sts/conf/server.xml

Expected result:

ciphers="TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256"

If each result returned does not match the expected result, this is a finding.

Vulnerability Number

V-258971

Documentable

False

Rule Version

VCST-80-000002

Severity Override Guidance

Check Content Reference

Target Key

5567