VCTR-67-000001 - The vCenter Server must prohibit password reuse for a minimum of five generations.

CAT|II

CCI|CCI-000200

Rule-ID|SV-243072r719459_rule

STIG-ID|VCTR-67-000001

Vuln-ID|V-243072

VCTR-67-000002 - The vCenter Server must not automatically refresh client sessions.

CCI|CCI-001133

Rule-ID|SV-243073r719462_rule

STIG-ID|VCTR-67-000002

Vuln-ID|V-243073

VCTR-67-000003 - The vCenter Server must enforce a 60-day maximum password lifetime restriction.

CCI|CCI-000199

Rule-ID|SV-243074r719465_rule

STIG-ID|VCTR-67-000003

Vuln-ID|V-243074

VCTR-67-000004 - The vCenter Server must terminate management sessions after 10 minutes of inactivity.

Rule-ID|SV-243075r719468_rule

STIG-ID|VCTR-67-000004

Vuln-ID|V-243075

VCTR-67-000005 - The vCenter Server users must have the correct roles assigned.

CCI|CCI-001082

Rule-ID|SV-243076r719471_rule

STIG-ID|VCTR-67-000005

Vuln-ID|V-243076

VCTR-67-000007 - The vCenter Server must manage excess capacity, bandwidth, or other redundancy to limit the effects of information-flooding types of denial-of-service (DoS) attacks by enabling Network I/O Control (NIOC).

CCI|CCI-000366

Rule-ID|SV-243077r816836_rule

STIG-ID|VCTR-67-000007

Vuln-ID|V-243077

VCTR-67-000008 - The vCenter Server must provide an immediate real-time alert to the SA and ISSO, at a minimum, of all audit failure events.

CCI|CCI-000139

Rule-ID|SV-243078r719644_rule

STIG-ID|VCTR-67-000008

Vuln-ID|V-243078

VCTR-67-000009 - The vCenter Server must implement Active Directory authentication.

CCI|CCI-000770

Rule-ID|SV-243079r719480_rule

STIG-ID|VCTR-67-000009

Vuln-ID|V-243079

VCTR-67-000010 - The vCenter Server must limit the use of the built-in SSO administrative account.

Rule-ID|SV-243080r719483_rule

STIG-ID|VCTR-67-000010

Vuln-ID|V-243080

VCTR-67-000012 - The vCenter Server must disable the distributed virtual switch health check.

Rule-ID|SV-243081r816839_rule

STIG-ID|VCTR-67-000012

Vuln-ID|V-243081

VCTR-67-000013 - The vCenter Server must set the distributed port group Forged Transmits policy to reject.

Rule-ID|SV-243082r816841_rule

STIG-ID|VCTR-67-000013

Vuln-ID|V-243082

VCTR-67-000014 - The vCenter Server must set the distributed port group MAC Address Change policy to reject.

Rule-ID|SV-243083r816843_rule

STIG-ID|VCTR-67-000014

Vuln-ID|V-243083

VCTR-67-000015 - The vCenter Server must set the distributed port group Promiscuous Mode policy to reject.

Rule-ID|SV-243084r816845_rule

STIG-ID|VCTR-67-000015

Vuln-ID|V-243084

VCTR-67-000016 - The vCenter Server must only send NetFlow traffic to authorized collectors.

Rule-ID|SV-243085r816847_rule

STIG-ID|VCTR-67-000016

Vuln-ID|V-243085

VCTR-67-000018 - The vCenter Server must configure all port groups to a value other than that of the native VLAN.

Rule-ID|SV-243086r816913_rule

STIG-ID|VCTR-67-000018

Vuln-ID|V-243086

VCTR-67-000019 - The vCenter Server must not configure VLAN Trunking unless Virtual Guest Tagging (VGT) is required and authorized.

Rule-ID|SV-243087r816914_rule

STIG-ID|VCTR-67-000019

Vuln-ID|V-243087

VCTR-67-000020 - The vCenter Server must not configure all port groups to VLAN values reserved by upstream physical switches.

Rule-ID|SV-243088r816854_rule

STIG-ID|VCTR-67-000020

Vuln-ID|V-243088

VCTR-67-000023 - The vCenter Server must configure the vpxuser auto-password to be changed every 30 days.

Rule-ID|SV-243089r719510_rule

STIG-ID|VCTR-67-000023

Vuln-ID|V-243089

VCTR-67-000024 - The vCenter Server must configure the vpxuser password meets length policy.

Rule-ID|SV-243090r719513_rule

STIG-ID|VCTR-67-000024

Vuln-ID|V-243090

VCTR-67-000025 - The vCenter Server must disable the managed object browser (MOB) at all times when not required for troubleshooting or maintenance of managed objects.

Rule-ID|SV-243091r719516_rule

STIG-ID|VCTR-67-000025

Vuln-ID|V-243091

VCTR-67-000026 - The vCenter Server must check the privilege reassignment after restarts.

Rule-ID|SV-243092r719519_rule

STIG-ID|VCTR-67-000026

Vuln-ID|V-243092

VCTR-67-000029 - The vCenter Server must enable all tasks to be shown to Administrators in the Web Client.

Rule-ID|SV-243093r719522_rule

STIG-ID|VCTR-67-000029

Vuln-ID|V-243093

VCTR-67-000031 - The vCenter Server must restrict the connectivity between Update Manager and public patch repositories by use of a separate Update Manager Download Server.

Rule-ID|SV-243094r719525_rule

STIG-ID|VCTR-67-000031

Vuln-ID|V-243094

VCTR-67-000033 - The vCenter Server must use a least-privileges assignment for the vCenter Server database user.

Rule-ID|SV-243095r719528_rule

STIG-ID|VCTR-67-000033

Vuln-ID|V-243095

VCTR-67-000034 - The vCenter Server must use unique service accounts when applications connect to vCenter.

Rule-ID|SV-243096r719531_rule

STIG-ID|VCTR-67-000034

Vuln-ID|V-243096

VCTR-67-000035 - vCenter Server plugins must be verified.

Rule-ID|SV-243097r719534_rule

STIG-ID|VCTR-67-000035

Vuln-ID|V-243097

VCTR-67-000036 - The vCenter Server must produce audit records containing information to establish what type of events occurred.

CCI|CCI-002702

Rule-ID|SV-243098r719537_rule

STIG-ID|VCTR-67-000036

Vuln-ID|V-243098

VCTR-67-000039 - The vCenter Server passwords must be at least 15 characters in length.

CCI|CCI-000205

Rule-ID|SV-243099r719540_rule

STIG-ID|VCTR-67-000039

Vuln-ID|V-243099

VCTR-67-000040 - The vCenter Server passwords must contain at least one uppercase character.

CCI|CCI-000192

Rule-ID|SV-243100r719543_rule

STIG-ID|VCTR-67-000040

Vuln-ID|V-243100

VCTR-67-000041 - The vCenter Server passwords must contain at least one lowercase character.

CCI|CCI-000193

Rule-ID|SV-243101r719546_rule

STIG-ID|VCTR-67-000041

Vuln-ID|V-243101

VCTR-67-000042 - The vCenter Server passwords must contain at least one numeric character.

CCI|CCI-000194

Rule-ID|SV-243102r719549_rule

STIG-ID|VCTR-67-000042

Vuln-ID|V-243102

VCTR-67-000043 - The vCenter Server passwords must contain at least one special character.

CCI|CCI-001619

Rule-ID|SV-243103r719552_rule

STIG-ID|VCTR-67-000043

Vuln-ID|V-243103

VCTR-67-000045 - The vCenter Server must limit the maximum number of failed login attempts to three.

CCI|CCI-002238

Rule-ID|SV-243104r719555_rule

STIG-ID|VCTR-67-000045

Vuln-ID|V-243104

VCTR-67-000046 - The vCenter Server must set the interval for counting failed login attempts to at least 15 minutes.

Rule-ID|SV-243105r719558_rule

STIG-ID|VCTR-67-000046

Vuln-ID|V-243105

VCTR-67-000047 - The vCenter Server must require an administrator to unlock an account locked due to excessive login failures.

Rule-ID|SV-243106r719561_rule

STIG-ID|VCTR-67-000047

Vuln-ID|V-243106

VCTR-67-000051 - The vCenter Server users must have the correct roles assigned.

CCI|CCI-001084

Rule-ID|SV-243107r719564_rule

STIG-ID|VCTR-67-000051

Vuln-ID|V-243107

VCTR-67-000052 - The vCenter Server must protect the confidentiality and integrity of transmitted information by isolating IP-based storage traffic.

Rule-ID|SV-243108r719567_rule

STIG-ID|VCTR-67-000052

Vuln-ID|V-243108

VCTR-67-000054 - The vCenter Server must disable or restrict the connectivity between vSAN Health Check and public Hardware Compatibility List by use of an external proxy server.

Rule-ID|SV-243110r719573_rule

STIG-ID|VCTR-67-000054

Vuln-ID|V-243110

VCTR-67-000055 - The vCenter Server must configure the vSAN Datastore name to a unique name.

Rule-ID|SV-243111r719576_rule

STIG-ID|VCTR-67-000055

Vuln-ID|V-243111

VCTR-67-000057 - The vCenter Server must enable TLS 1.2 exclusively.

Rule-ID|SV-243112r816857_rule

STIG-ID|VCTR-67-000057

Vuln-ID|V-243112

VCTR-67-000058 - The vCenter Server Machine SSL certificate must be issued by a DoD certificate authority.

Rule-ID|SV-243113r719582_rule

STIG-ID|VCTR-67-000058

Vuln-ID|V-243113

VCTR-67-000059 - The vCenter Server must enable certificate based authentication.

Rule-ID|SV-243114r719585_rule

STIG-ID|VCTR-67-000059

Vuln-ID|V-243114

VCTR-67-000060 - The vCenter Server must enable revocation checking for certificate-based authentication.

Rule-ID|SV-243115r719588_rule

STIG-ID|VCTR-67-000060

Vuln-ID|V-243115

VCTR-67-000061 - The vCenter Server must disable Password and Windows integrated authentication.

Rule-ID|SV-243116r719591_rule

STIG-ID|VCTR-67-000061

Vuln-ID|V-243116

VCTR-67-000062 - The vCenter Server must enable the login banner for vSphere Client.

Rule-ID|SV-243117r719594_rule

STIG-ID|VCTR-67-000062

Vuln-ID|V-243117

VCTR-67-000063 - The vCenter Server must restrict access to the cryptographic role.

Rule-ID|SV-243118r719597_rule

STIG-ID|VCTR-67-000063

Vuln-ID|V-243118

VCTR-67-000064 - The vCenter Server must restrict access to cryptographic permissions.

Detections

Analytics

DISA STIG VMware vSphere 6.7 vCenter v1r2

Warning! Audit Deprecated

Audit Details

Audit Changelog

Revision 1.1

Miscellaneous

Revision 1.0

Miscellaneous


Revision 1.1 Feb 27, 2023 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.0 Jun 10, 2022 Miscellaneous Metadata updated.