STIGQter: STIG Summary: VMware NSX 4.x Manager NDM Security Technical Implementation Guide Version: 1 Release: 2 Benchmark Date: 30 Jan 2025:

The NSX Manager must only enable TLS 1.2 or greater.

DISA Rule

SV-265315r994168_rule

Vulnerability Number

V-265315

Group Title

SRG-APP-000156-NDM-000250

Rule Version

NMGR-4X-000038

Severity

CAT I

CCI(s)

• CCI-001941 - Implement replay-resistant authentication mechanisms for access to privileged accounts and/or non-privileged accounts.
• CCI-000197 - For password-based authentication, transmit passwords only cryptographically-protected channels.

Weight

10

Fix Recommendation

Capture the output from the check GET command and update the TLS 1.1 protocol to false.

Run the following API call using curl or another REST API client:

PUT https://<nsx-mgr>/api/v1/cluster/api-service

Example request body:

{
"session_timeout": 1800,
"connection_timeout": 30,
"protocol_versions": [
{
"name": "TLSv1.1",
"enabled": false
},
{
"name": "TLSv1.2",
"enabled": true
},
{
"name": "TLSv1.3",
"enabled": true
}
],
"cipher_suites": [
{
"name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
"enabled": true
},
{
"name": "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
"enabled": true
},
{
"name": "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
"enabled": true
},
{
"name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
"enabled": true
},
{
"name": "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
"enabled": true
},
{
"name": "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
"enabled": true
},
{
"name": "TLS_RSA_WITH_AES_128_CBC_SHA",
"enabled": true
},
{
"name": "TLS_RSA_WITH_AES_128_CBC_SHA256",
"enabled": true
},
{
"name": "TLS_RSA_WITH_AES_128_GCM_SHA256",
"enabled": true
},
{
"name": "TLS_RSA_WITH_AES_256_CBC_SHA",
"enabled": true
},
{
"name": "TLS_RSA_WITH_AES_256_CBC_SHA256",
"enabled": true
},
{
"name": "TLS_RSA_WITH_AES_256_GCM_SHA384",
"enabled": true
},
{
"name": "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
"enabled": true
},
{
"name": "TLS_AES_128_GCM_SHA256",
"enabled": true
},
{
"name": "TLS_AES_256_GCM_SHA384",
"enabled": true
},
{
"name": "TLS_CHACHA20_POLY1305_SHA256",
"enabled": true
}
],
"redirect_host": "",
"client_api_rate_limit": 100,
"global_api_concurrency_limit": 199,
"client_api_concurrency_limit": 40,
"basic_authentication_enabled": true,
"cookie_based_authentication_enabled": true,
"resource_type": "ApiServiceConfig",
"id": "reverse_proxy_config",
"display_name": "reverse_proxy_config",
"_create_time": 1703175890703,
"_create_user": "system",
"_last_modified_time": 1703175890703,
"_last_modified_user": "system",
"_system_owned": false,
"_protection": "NOT_PROTECTED",
"_revision": 0
}

Note: Changes are applied to all nodes in the cluster. The API service on each node will restart after it is updated using this API. There may be a delay of up to a minute or so between the time this API call completes and when the new configuration goes into effect.

Check Contents

Viewing TLS protocol enablement must be done via the API.

Execute the following API call using curl or another REST API client:

GET https://<nsx-mgr>/api/v1/cluster/api-service

Example result:

"protocol_versions": [
{
"name": "TLSv1.1",
"enabled": false
},
{
"name": "TLSv1.2",
"enabled": true
},
{
"name": "TLSv1.3",
"enabled": true
}
]

If TLS 1.1 is enabled, this is a finding.

Vulnerability Number

V-265315

Documentable

False

Rule Version

NMGR-4X-000038

Severity Override Guidance

Viewing TLS protocol enablement must be done via the API.

Execute the following API call using curl or another REST API client:

GET https://<nsx-mgr>/api/v1/cluster/api-service

Example result:

"protocol_versions": [
{
"name": "TLSv1.1",
"enabled": false
},
{
"name": "TLSv1.2",
"enabled": true
},
{
"name": "TLSv1.3",
"enabled": true
}
]

If TLS 1.1 is enabled, this is a finding.

Check Content Reference

M

Target Key

5633