OpenControls Logo

STIG Viewer

STIGViewer Support

The Security Token Service must limit the number of allowed connections.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-256763VCST-70-000019SV-256763r889259_ruleCCI-001094medium
Description
Limiting the number of established connections to the Security Token Service is a basic denial-of-service protection. Servers where the limit is too high or unlimited can potentially run out of system resources and negatively affect system availability.
STIGDate
VMware vSphere 7.0 vCenter Appliance STS Security Technical Implementation Guide2023-06-15

Related Frameworks

1 mapping across 4 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CAP-02Resource Priority
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (16) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-3Access Enforcement
1.00
AC-6(10)Prohibit Non-privileged Users from Executing Privileged Functions
1.00
AC-6(8)Privilege Levels for Code Execution
1.00
CM-11(2)Software Installation with Privileged Status
1.00
CM-5(1)Automated Access Enforcement and Audit Records
1.00
CM-5(6)Limit Library Privileges
1.00
CM-6Configuration Settings
1.00
CM-7Least Functionality
1.00
CM-7(2)Prevent Program Execution
1.00
SC-18(1)Identify Unacceptable Code and Take Corrective Actions
1.00

+6 more (top 10 by confidence shown)

CCI1 mapping
CCI-001094
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 4 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.IR-04
0.50

Details

Check Text (C-256763r889259_chk)

At the command prompt, run the following command: # xmllint --xpath '/Server/Service/Connector[@port="${bio-custom.http.port}"]/@acceptCount' /usr/lib/vmware-sso/vmware-sts/conf/server.xml Expected result: acceptCount="100" If the output does not match the expected result, this is a finding.

Fix Text (F-60381r889258_fix)

Navigate to and open: /usr/lib/vmware-sso/vmware-sts/conf/server.xml Navigate to the <Connector> configured with port="${bio-custom.http.port}". Add or change the following value: acceptCount="100" Restart the service with the following command: # vmon-cli --restart sts