STIGQter: STIG Summary: VMware vRealize Operations Manager 6.x Application Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 28 Sep 2018:

The vRealize Operations server must only allow the use of DoD PKI-established certificate authorities for verification of the establishment of protected sessions.

DISA Rule

SV-98861r1_rule

Vulnerability Number

V-88211

Group Title

SRG-APP-000427-AS-000264

Rule Version

VROM-AP-000540

Severity

CAT II

CCI(s)

• CCI-002470 - The information system only allows the use of organization-defined certificate authorities for verification of the establishment of protected sessions.

Weight

10

Fix Recommendation

Configure vROps Single Sign-On (SSO) with the following steps:

1. Log on to vRealize Operations Manager as an administrator.
2. In the menu, click Administration, and then in the left pane click Access >> Authentication Sources.
3. Click "Add".
4. In the Add Source for User and Group Import dialog box, provide information for the single sign-on source.
5. Click "Test" to test the source connection.
6. Click "OK". The certificate details are displayed.
7. Select the "Accept this Certificate" check box.
8. Click "OK".
9. In the "Import User Groups" dialog box, import user accounts from an SSO server on another machine.
10. In the list of user groups displayed, select at least one user group.
11. Click "Next".
12. In the "Roles and Objects" pane, select a role from the "Select Role" drop-down menu.
13. Select the "Assign this role to the group" check box.
14. Select the "objects" users of the group can access when holding this role.

To assign permissions so that users can access all the objects in vRealize Operations Manager:

1. Select the "Allow access to all objects in the system" check box.
2. Click "OK".

Note: For complete details review vROps 6.x and vSphere SSO product documentation.

Check Contents

Verify that the vROps Single Sign-On (SSO) is configured with the correct authentication source only (DoD PKI CAC enabled vSphere SSO instance) by using the following steps:

1. Log on to the admin UI as the administrator.
2. In the menu, click Administration, and then in the left pane click Access >> Authentication Sources.
3. Review the authentication sources and ensure that only the DoD PKI CAC enabled vSphere SSO instance is available as an authentication source.

If there is no authentication source, or multiple non-DoD PKI CAC enabled vSphere SSO instance authentication sources exist, this is a finding.

Vulnerability Number

V-88211

Documentable

False

Rule Version

VROM-AP-000540

Severity Override Guidance

Verify that the vROps Single Sign-On (SSO) is configured with the correct authentication source only (DoD PKI CAC enabled vSphere SSO instance) by using the following steps:

1. Log on to the admin UI as the administrator.
2. In the menu, click Administration, and then in the left pane click Access >> Authentication Sources.
3. Review the authentication sources and ensure that only the DoD PKI CAC enabled vSphere SSO instance is available as an authentication source.

If there is no authentication source, or multiple non-DoD PKI CAC enabled vSphere SSO instance authentication sources exist, this is a finding.

Check Content Reference

M

Target Key

3453

Comments