The vCenter Server must disable Username/Password and Windows Integrated Authentication.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-258950 | VCSA-80-000283 | SV-258950r934508_rule | CCI-000366 | medium |
| Description | ||||
| All forms of authentication other than Common Access Card (CAC) must be disabled. Password authentication can be temporarily reenabled for emergency access to the local Single Sign-On (SSO) accounts or Active Directory user/pass accounts, but it must be disabled as soon as CAC authentication is functional. | ||||
| STIG | Date | |||
| VMware vSphere 8.0 vCenter Security Technical Implementation Guide | 2023-10-11 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
CM-6
1.00
- DISA · V1R1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.4.1
1.00
- DISA · V1R1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.4.2
1.00
- DISA · V1R1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000366
1.00
- DISA · V1R1 · disa_xccdf · related
Details
Check Text (C-258950r934508_chk)
If a federated identity provider is configured and used for an identity source, this is not applicable.
From the vSphere Client, go to Administration >> Single Sign On >> Configuration >> Identity Provider >> Smart Card Authentication.
Under "Authentication method", examine the allowed methods.
If "Smart card authentication" is not enabled and "Password and windows session authentication" is not disabled, this is a finding.
Fix Text (F-62599r934507_fix)
From the vSphere Client, go to Administration >> Single Sign On >> Configuration >> Identity Provider >> Smart Card Authentication.
Next to "Authentication method", click "Edit".
Select to radio button to "Enable smart card authentication".
Click "Save".
To re-enable password authentication for troubleshooting purposes, run the following command on the vCenter Server Appliance:
# /opt/vmware/bin/sso-config.sh -set_authn_policy -pwdAuthn true -winAuthn false -certAuthn false -securIDAuthn false -t vsphere.local