VCSA-70-000294 - vCenter Native Key Providers must be backed up with a strong password.

Information

The vCenter Native Key Provider feature was introduced in U2 and acts as a key provider for encryption-based capabilities, such as encrypted virtual machines without requiring an external KMS solution. When enabling this feature, a backup must be taken that is a PKCS#12 formatted file. If no password is provided during the backup process, this presents the opportunity for this to be used maliciously and compromise the environment.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

From the vSphere Client, go to Host and Clusters.

Select a vCenter Server >> Configure >> Security >> Key Providers.

Select the Native Key Provider, click 'Back-up', and check the box 'Protect Native Key Provider data with password'.

Provide a strong password and click 'Back up key provider'.

Delete any previous backups that were not protected with a password.

Item Details

Audit Name: DISA STIG VMware vSphere 7.0 vCenter v1r3

Category: CONFIGURATION MANAGEMENT

Plugin: VMware

Control ID: ef7102f0a4695219e6c4c7b5b4358e9ba36fa04cc2724cd8d11224d83f000137

Detections

Analytics

VCSA-70-000294 - vCenter Native Key Providers must be backed up with a strong password.

Information

Solution

See Also

Item Details