VAMI must implement Transport Layer Security (TLS) 1.2 exclusively.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-256668 | VCLD-70-000024 | SV-256668r888526_rule | CCI-002418 | medium |
| Description | ||||
| TLS is a required transmission protocol for a web server hosting controlled information. The use of TLS provides confidentiality of data in transit between the web server and client. FIPS 140-2 approved TLS versions must be enabled, and non-FIPS-approved Secure Sockets Layer (SSL) versions must be disabled. VAMI comes configured to use only TLS 1.2. This configuration must be verified and maintained. Satisfies: SRG-APP-000439-WSR-000156, SRG-APP-000442-WSR-000182 | ||||
| STIG | Date | |||
| VMware vSphere 7.0 VAMI Security Technical Implementation Guide | 2023-06-15 | |||
Details
Check Text (C-256668r888526_chk)
At the command prompt, run the following command:
# /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2>/dev/null|grep "ssl.use"|sed 's: ::g'
Expected result:
ssl.use-sslv2="disable"
ssl.use-sslv3="disable"
ssl.use-tlsv10="disable"
ssl.use-tlsv11="disable"
ssl.use-tlsv12="enable"
If the output does not match the expected result, this is a finding.
Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details:
https://kb.vmware.com/s/article/2100508
Fix Text (F-60286r888525_fix)
Navigate to and open:
/opt/vmware/etc/lighttpd/lighttpd.conf
Replace all "ssl.use-*" lines with the following:
ssl.use-sslv2="disable"
ssl.use-sslv3="disable"
ssl.use-tlsv10="disable"
ssl.use-tlsv11="disable"
ssl.use-tlsv12="enable"
Restart the service with the following command:
# vmon-cli --restart applmgmt