Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-94481 | ESXI-65-000073 | SV-104311r1_rule | Medium |
Description |
---|
TLS 1.0 and 1.1 are deprecated protocols with well published shortcomings and vulnerabilities. TLS 1.2 should be enabled on all interfaces and SSLv3, TL 1.1 and 1.0 disabled where supported. Mandating TLS 1.2 may break third party integrations and add-ons to vSphere. Test these integrations carefully after implementing TLS 1.2 and roll back where appropriate. On interfaces where required functionality is broken with TLS 1.2 this finding is N/A until such time as the third party software supports TLS 1.2. Make sure you modify TLS settings in the following order: 1. Platform Services Controllers (if applicable), 2. vCenter, 3. ESXi |
STIG | Date |
---|---|
VMware vSphere 6.5 ESXi Security Technical Implementation Guide | 2019-12-13 |
Check Text ( C-93667r1_chk ) |
---|
Temporarily enable SSH, connect to the ESXi host and run the following command: grep "enableTLS" /etc/sfcb/sfcb.cfg If the output indicates that any protocol is enabled other than TLSv1_2, this is a finding. |
Fix Text (F-100597r1_fix) |
---|
Temporarily enable SSH, connect to the ESXi host and run the following command: cp -f /etc/sfcb/sfcb.cfg /etc/sfcb/sfcb.cfg.orig grep -v "enableTLS" /etc/sfcb/sfcb.cfg.orig>/etc/sfcb/sfcb.cfg echo enableTLSv1: false>>sfcb.cfg echo enableTLSv1_1: false>>sfcb.cfg echo enableTLSv1_2: true>>sfcb.cfg /etc/init.d/sfcbd-watchdog restart |