VCTR-67-000001 - The vCenter Server must prohibit password reuse for a minimum of five generations.

800-53|IA-5(1)(e)

CAT|II

CCI|CCI-000200

Rule-ID|SV-243072r879602_rule

STIG-ID|VCTR-67-000001

Vuln-ID|V-243072

VCTR-67-000002 - The vCenter Server must not automatically refresh client sessions.

800-53|SC-10

CCI|CCI-001133

Rule-ID|SV-243073r879622_rule

STIG-ID|VCTR-67-000002

Vuln-ID|V-243073

VCTR-67-000003 - The vCenter Server must enforce a 60-day maximum password lifetime restriction.

800-53|IA-5(1)(d)

CCI|CCI-000199

Rule-ID|SV-243074r879611_rule

STIG-ID|VCTR-67-000003

Vuln-ID|V-243074

VCTR-67-000004 - The vCenter Server must terminate management sessions after 10 minutes of inactivity.

Rule-ID|SV-243075r879622_rule

STIG-ID|VCTR-67-000004

Vuln-ID|V-243075

VCTR-67-000005 - The vCenter Server users must have the correct roles assigned.

800-53|SC-2

CCI|CCI-001082

Rule-ID|SV-243076r879631_rule

STIG-ID|VCTR-67-000005

Vuln-ID|V-243076

VCTR-67-000007 - The vCenter Server must manage excess capacity, bandwidth, or other redundancy to limit the effects of information-flooding types of denial-of-service (DoS) attacks by enabling Network I/O Control (NIOC).

800-53|CM-6b.

CCI|CCI-000366

Rule-ID|SV-243077r879887_rule

STIG-ID|VCTR-67-000007

Vuln-ID|V-243077

VCTR-67-000008 - The vCenter Server must provide an immediate real-time alert to the SA and ISSO, at a minimum, of all audit failure events.

800-53|AU-5a.

CCI|CCI-000139

Rule-ID|SV-243078r879570_rule

STIG-ID|VCTR-67-000008

Vuln-ID|V-243078

VCTR-67-000009 - The vCenter Server must implement Active Directory authentication.

800-53|IA-2(5)

CCI|CCI-000770

Rule-ID|SV-243079r879594_rule

STIG-ID|VCTR-67-000009

Vuln-ID|V-243079

VCTR-67-000010 - The vCenter Server must limit the use of the built-in SSO administrative account.

Rule-ID|SV-243080r879594_rule

STIG-ID|VCTR-67-000010

Vuln-ID|V-243080

VCTR-67-000012 - The vCenter Server must disable the distributed virtual switch health check.

Rule-ID|SV-243081r879887_rule

STIG-ID|VCTR-67-000012

Vuln-ID|V-243081

VCTR-67-000013 - The vCenter Server must set the distributed port group Forged Transmits policy to reject.

Rule-ID|SV-243082r879887_rule

STIG-ID|VCTR-67-000013

Vuln-ID|V-243082

VCTR-67-000014 - The vCenter Server must set the distributed port group MAC Address Change policy to reject.

Rule-ID|SV-243083r879887_rule

STIG-ID|VCTR-67-000014

Vuln-ID|V-243083

VCTR-67-000015 - The vCenter Server must set the distributed port group Promiscuous Mode policy to reject.

Rule-ID|SV-243084r879887_rule

STIG-ID|VCTR-67-000015

Vuln-ID|V-243084

VCTR-67-000016 - The vCenter Server must only send NetFlow traffic to authorized collectors.

Rule-ID|SV-243085r879887_rule

STIG-ID|VCTR-67-000016

Vuln-ID|V-243085

VCTR-67-000018 - The vCenter Server must configure all port groups to a value other than that of the native VLAN.

Rule-ID|SV-243086r879887_rule

STIG-ID|VCTR-67-000018

Vuln-ID|V-243086

VCTR-67-000019 - The vCenter Server must not configure VLAN Trunking unless Virtual Guest Tagging (VGT) is required and authorized.

Rule-ID|SV-243087r879887_rule

STIG-ID|VCTR-67-000019

Vuln-ID|V-243087

VCTR-67-000020 - The vCenter Server must not configure all port groups to VLAN values reserved by upstream physical switches.

Rule-ID|SV-243088r879887_rule

STIG-ID|VCTR-67-000020

Vuln-ID|V-243088

VCTR-67-000023 - The vCenter Server must configure the vpxuser auto-password to be changed every 30 days.

Rule-ID|SV-243089r879887_rule

STIG-ID|VCTR-67-000023

Vuln-ID|V-243089

VCTR-67-000024 - The vCenter Server must configure the vpxuser password meets length policy.

Rule-ID|SV-243090r879887_rule

STIG-ID|VCTR-67-000024

Vuln-ID|V-243090

VCTR-67-000025 - The vCenter Server must disable the managed object browser (MOB) at all times when not required for troubleshooting or maintenance of managed objects.

Rule-ID|SV-243091r879887_rule

STIG-ID|VCTR-67-000025

Vuln-ID|V-243091

VCTR-67-000026 - The vCenter Server must check the privilege reassignment after restarts.

Rule-ID|SV-243092r879887_rule

STIG-ID|VCTR-67-000026

Vuln-ID|V-243092

VCTR-67-000029 - The vCenter Server must enable all tasks to be shown to Administrators in the Web Client.

Rule-ID|SV-243093r879887_rule

STIG-ID|VCTR-67-000029

Vuln-ID|V-243093

VCTR-67-000031 - The vCenter Server must restrict the connectivity between Update Manager and public patch repositories by use of a separate Update Manager Download Server.

Rule-ID|SV-243094r879887_rule

STIG-ID|VCTR-67-000031

Vuln-ID|V-243094

VCTR-67-000033 - The vCenter Server must use a least-privileges assignment for the vCenter Server database user.

Rule-ID|SV-243095r879887_rule

STIG-ID|VCTR-67-000033

Vuln-ID|V-243095

VCTR-67-000034 - The vCenter Server must use unique service accounts when applications connect to vCenter.

Rule-ID|SV-243096r879887_rule

STIG-ID|VCTR-67-000034

Vuln-ID|V-243096

VCTR-67-000035 - vCenter Server plugins must be verified.

Rule-ID|SV-243097r879887_rule

STIG-ID|VCTR-67-000035

Vuln-ID|V-243097

VCTR-67-000036 - The vCenter Server must produce audit records containing information to establish what type of events occurred.

800-53|SI-6d.

CCI|CCI-002702

Rule-ID|SV-243098r879845_rule

STIG-ID|VCTR-67-000036

Vuln-ID|V-243098

VCTR-67-000039 - The vCenter Server passwords must be at least 15 characters in length.

800-53|IA-5(1)(a)

CCI|CCI-000205

Rule-ID|SV-243099r879601_rule

STIG-ID|VCTR-67-000039

Vuln-ID|V-243099

VCTR-67-000040 - The vCenter Server passwords must contain at least one uppercase character.

CCI|CCI-000192

Rule-ID|SV-243100r879603_rule

STIG-ID|VCTR-67-000040

Vuln-ID|V-243100

VCTR-67-000041 - The vCenter Server passwords must contain at least one lowercase character.

CCI|CCI-000193

Rule-ID|SV-243101r879604_rule

STIG-ID|VCTR-67-000041

Vuln-ID|V-243101

VCTR-67-000042 - The vCenter Server passwords must contain at least one numeric character.

CCI|CCI-000194

Rule-ID|SV-243102r879605_rule

STIG-ID|VCTR-67-000042

Vuln-ID|V-243102

VCTR-67-000043 - The vCenter Server passwords must contain at least one special character.

CCI|CCI-001619

Rule-ID|SV-243103r879606_rule

STIG-ID|VCTR-67-000043

Vuln-ID|V-243103

VCTR-67-000045 - The vCenter Server must limit the maximum number of failed login attempts to three.

800-53|AC-7b.

CCI|CCI-002238

Rule-ID|SV-243104r879722_rule

STIG-ID|VCTR-67-000045

Vuln-ID|V-243104

VCTR-67-000046 - The vCenter Server must set the interval for counting failed login attempts to at least 15 minutes.

Rule-ID|SV-243105r879722_rule

STIG-ID|VCTR-67-000046

Vuln-ID|V-243105

VCTR-67-000047 - The vCenter Server must require an administrator to unlock an account locked due to excessive login failures.

Rule-ID|SV-243106r879722_rule

STIG-ID|VCTR-67-000047

Vuln-ID|V-243106

VCTR-67-000051 - The vCenter Server users must have the correct roles assigned.

800-53|SC-3

CCI|CCI-001084

Rule-ID|SV-243107r879643_rule

STIG-ID|VCTR-67-000051

Vuln-ID|V-243107

VCTR-67-000052 - The vCenter Server must protect the confidentiality and integrity of transmitted information by isolating IP-based storage traffic.

Rule-ID|SV-243108r879887_rule

STIG-ID|VCTR-67-000052

Vuln-ID|V-243108

VCTR-67-000054 - The vCenter Server must disable or restrict the connectivity between vSAN Health Check and public Hardware Compatibility List by use of an external proxy server.

Rule-ID|SV-243110r879887_rule

STIG-ID|VCTR-67-000054

Vuln-ID|V-243110

VCTR-67-000055 - The vCenter Server must configure the vSAN Datastore name to a unique name.

Rule-ID|SV-243111r879887_rule

STIG-ID|VCTR-67-000055

Vuln-ID|V-243111

VCTR-67-000057 - The vCenter Server must enable TLS 1.2 exclusively.

Rule-ID|SV-243112r879887_rule

STIG-ID|VCTR-67-000057

Vuln-ID|V-243112

VCTR-67-000058 - The vCenter Server Machine SSL certificate must be issued by a DoD certificate authority.

Rule-ID|SV-243113r879887_rule

STIG-ID|VCTR-67-000058

Vuln-ID|V-243113

VCTR-67-000059 - The vCenter Server must enable certificate based authentication.

Rule-ID|SV-243114r879887_rule

STIG-ID|VCTR-67-000059

Vuln-ID|V-243114

VCTR-67-000060 - The vCenter Server must enable revocation checking for certificate-based authentication.

Rule-ID|SV-243115r879887_rule

STIG-ID|VCTR-67-000060

Vuln-ID|V-243115

VCTR-67-000061 - The vCenter Server must disable Password and Windows integrated authentication.

Detections

Analytics

DISA STIG VMware vSphere 6.7 vCenter v1r4

Audit Details

File Details

Audit Changelog

Revision 1.1

Miscellaneous