The vCenter Server must limit membership to the "TrustedAdmins" Single Sign-On (SSO) group.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
| V-258957 | VCSA-80-000291 | SV-258957r934529_rule | CCI-000366 | medium |
| Description | ||||
| The vSphere "TrustedAdmins" group grants additional rights to administer the vSphere Trust Authority feature. To force accountability and nonrepudiation, the SSO group "TrustedAdmins" must be severely restricted. | ||||
| STIG | Date | |||
| VMware vSphere 8.0 vCenter Security Technical Implementation Guide | 2023-10-11 | |||
Related Frameworks
4 paths across 3 frameworks
Related Frameworks
NIST 800-531 mapping
CM-6
1.00
- DISA · V1R1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
NIST 800-1712 mappings
3.4.1
1.00
- DISA · V1R1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
3.4.2
1.00
- DISA · V1R1 · disa_xccdf · related
- DISA · 2025-01-23 · disa_cci_list · equivalent
- NIST · Rev 2 (Feb 2020, errata Jan 2021) · nist_800_171_app_d · equivalent
CCI1 mapping
CCI-000366
1.00
- DISA · V1R1 · disa_xccdf · related
Details
Check Text (C-258957r934529_chk)
From the vSphere Client, go to Administration >> Single Sign On >> Users and Groups >> Groups.
Click the next page arrow until the "TrustedAdmins" group appears.
Click "TrustedAdmins".
Review the members of the group and ensure that only authorized accounts are present.
Note: These accounts act as root on the Photon operating system and have the ability to severely damage vCenter, inadvertently or otherwise.
If there are any accounts present as members of TrustedAdmins that are not authorized, this is a finding.
Fix Text (F-62606r934528_fix)
From the vSphere Client, go to Administration >> Single Sign On >> Users and Groups >> Groups.
Click the next page arrow until the "TrustedAdmins" group appears.
Click "TrustedAdmins".
Click the three vertical dots next to the name of each unauthorized account.
Select "Remove Member".