ESXI-70-000086 - The ESXi host must verify certificates for SSL syslog endpoints.

Information

When sending syslog data to a remote host, ESXi can be configured to use any combination of TCP, UDP and SSL transports. When using SSL, the server certificate must be validated to ensure that the host is connecting to a valid syslog server.

Solution

To configure SSL syslog endpoint certificate checking it must be turned on and also the trusted certificate chain must be added to ESXi's trusted store.

From the vSphere Client go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Advanced System Settings.

Select the 'Syslog.global.logCheckSSLCerts' value and set it to 'true'.

Copy the PEM formatted trusted CA certificate so that is accessible to the host and append the contents to /etc/vmware/ssl/castore.pem by running the follow command:

# <path/to/cacert> >> /etc/vmware/ssl/castore.pem

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name Syslog.global.logCheckSSLCerts | Set-AdvancedSetting -Value 'true'

Copy the PEM formatted trusted CA certificate so that is accessible to the host.

$esxcli = Get-EsxCli -v2
$arguments = $esxcli.system.security.certificatestore.add.CreateArgs()
$arguments.filename = <path/to/cacert>
$esxcli.system.security.certificatestore.add.Invoke($arguments)

Item Details

Audit Name: DISA VMware vSphere 7.0 ESXi STIG v1r4 VMware

Category: CONFIGURATION MANAGEMENT

Plugin: VMware

Control ID: fef0cd2ecc2d73f2bce75c76166604a89fcb7bd5d35ede2adb40ccaec82dea9e

Detections

Analytics

ESXI-70-000086 - The ESXi host must verify certificates for SSL syslog endpoints.

Information

Solution

See Also

Item Details