The vCenter Server must require multifactor authentication.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-256324 | VCSA-70-000060 | SV-256324r885583_rule | CCI-000166 | medium |
| Description | ||||
| Without the use of multifactor authentication, the ease of access to privileged functions is greatly increased. Multifactor authentication requires using two or more factors to achieve authentication. Factors include: (i) something a user knows (e.g., password/PIN); (ii) something a user has (e.g., cryptographic identification device, token); or (iii) something a user is (e.g., biometric). Satisfies: SRG-APP-000149, SRG-APP-000080, SRG-APP-000150, SRG-APP-000391, SRG-APP-000402 | ||||
| STIG | Date | |||
| VMware vSphere 7.0 vCenter Security Technical Implementation Guide | 2023-12-21 | |||
Details
Check Text (C-256324r885583_chk)
From the vSphere Web Client, go to Administration >> Single Sign On >> Configuration >> Identity Provider.
If the embedded identity provider is used, click on "Smart Card Authentication".
If the embedded identity provider is used and "Smart Card Authentication" is not enabled, this is a finding.
If a third-party identity provider is used, such as Microsoft ADFS, and it does not require multifactor authentication to log on to vCenter, this is a finding.
Fix Text (F-59942r885582_fix)
To configure smart card authentication for vCenter when using the embedded identity provider, refer to the supplemental document.
For vCenter Servers using a third-party identity provider, consult the product's documentation for enabling multifactor authentication.