OpenControls Logo

STIG Viewer

STIGViewer Support

The vCenter STS service must be configured to use strong encryption ciphers.

Overview

Finding IDVersionRule IDIA ControlsSeverity
V-258971VCST-80-000002SV-258971r934571_ruleCCI-000068medium
Description
Tomcat has several remote communications channels. Examples are user requests via http/https, communication to a backend database, or communication to authenticate users. The encryption used to communicate must match the data that is being retrieved or presented. The Tomcat <Connector> element controls the TLS protocol and the associated ciphers used. If a strong cipher is not selected, an attacker may be able to circumvent encryption protections that are configured for the connector. Strong ciphers must be employed when configuring a secured connector. TLSv1.2 or TLSv1.3 ciphers are configured via the server.xml file on a per connector basis. For a list of approved ciphers, refer to NIST SP 800-52 section 3.3.1.1. Satisfies: SRG-APP-000014-AS-000009, SRG-APP-000015-AS-000010, SRG-APP-000172-AS-000120, SRG-APP-000172-AS-000121, SRG-APP-000439-AS-000274
STIGDate
VMware vSphere 8.0 vCenter Appliance Secure Token Service (STS) Security Technical Implementation Guide2023-10-29

Related Frameworks

4 mappings across 5 frameworks
SCF0 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (8) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

CRY-01Use of Cryptographic Controls
1.00
CRY-03Transmission Confidentiality
1.00
CRY-04Transmission Integrity
1.00
DCH-01Data Protection
1.00
NET-14.2Protection of Confidentiality / Integrity Using Encryption
1.00
IAC-10Authenticator Management
0.50
IAC-10.1Password-Based Authentication
0.50
IAC-10.4Automated Support For Password Strength
0.50
NIST 800-530 mappings

No source states a mapping between these directly.

Also reachable in 2 hops (69) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

AC-10Concurrent Session Control
1.00
AC-17(1)Monitoring and Control
1.00
AC-17(2)Protection of Confidentiality and Integrity Using Encryption
1.00
AC-18(1)Authentication and Encryption
1.00
AC-2(1)Automated System Account Management
1.00
AC-2(10)Shared and Group Account Credential Change
1.00
AC-2(11)Usage Conditions
1.00
AC-2(2)Automated Temporary and Emergency Account Management
1.00
AC-2(3)Disable Accounts
1.00
AC-2(4)Automated Audit Actions
1.00

+59 more (top 10 by confidence shown)

NIST 800-1710 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (6) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

3.1.13
1.00
3.13.8
1.00
3.5.10
1.00
3.5.7
1.00
3.5.8
1.00
3.5.9
1.00
CCI4 mappings
CCI-000068
1.00
CCI-000197
1.00
CCI-001453
1.00
CCI-002418
1.00
NIST CSF 2.00 mappings

No source states a mapping between these directly.

Also reachable in 3 hops (1) derived by us, not asserted by any source

Each of these is a route we composed by chaining published mappings. No publisher states a relationship between the two endpoints.

PR.DS-02
1.00

Who does this work

8 NICE work roles and 7 EC-Council certifications.

This is an inference across published mappings, not a single claim by anyone. This check maps to a control, which maps to a Cybersecurity Framework outcome, which NIST assigns to the work roles below. EC-Council separately maps its certifications to those same roles.

A certification prepares someone for a role. It is not evidence that a holder is qualified, and neither NIST nor EC-Council has stated that any certification here addresses this check.

Work-role assignments published by NIST (NICE Framework Components 2.2.0 and the CSF 2.0 OLIR crosswalk). Certification mappings published by EC-Council.

Details

Check Text (C-258971r934571_chk)

At the command prompt, run the following command: # xmllint --xpath '/Server/Service/Connector/SSLHostConfig/@ciphers' /usr/lib/vmware-sso/vmware-sts/conf/server.xml Expected result: ciphers="TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" If each result returned does not match the expected result, this is a finding.

Fix Text (F-62620r934570_fix)

Navigate to and open: /usr/lib/vmware-sso/vmware-sts/conf/server.xml For each connector with "SSLEnabled" set to true, configure the ciphers attribute under the "SSLHostConfig" as follows: ciphers="TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" Restart the service with the following command: # vmon-cli --restart sts