Detections
Analytics

1.47 VCSA-80-000283

Information

The vCenter Server must disable Username/Password and Windows Integrated Authentication.

GROUP ID: V-258950RULE ID: SV-258950r961863

All forms of authentication other than Common Access Card (CAC) must be disabled. Password authentication can be temporarily reenabled for emergency access to the local Single Sign-On (SSO) accounts or Active Directory user/pass accounts, but it must be disabled as soon as CAC authentication is functional.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

From the vSphere Client, go to Administration >> Single Sign On >> Configuration >> Identity Provider >> Smart Card Authentication.

Next to "Authentication method", click "Edit".

Select to radio button to "Enable smart card authentication".

Click "Save".

To re-enable password authentication for troubleshooting purposes, run the following command on the vCenter Server Appliance:

/opt/vmware/bin/sso-config.sh -set_authn_policy -pwdAuthn true -winAuthn false -certAuthn false -securIDAuthn false -t vsphere.local

See Also

https://workbench.cisecurity.org/benchmarks/23621

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-258950r961863_rule, STIG-ID|VCSA-80-000283, Vuln-ID|V-258950

Plugin: VMware

Control ID: ff5c1aacc532857b819ae692fecceb36c5bbaee4572266b994765729d6120636