Detections
Analytics

VCSA-80-000294 - The vCenter server Native Key Provider must be backed up with a strong password.

Information

The vCenter Native Key Provider feature was introduced in 7.0 U2 and acts as a key provider for encryption-based capabilities such as encrypted virtual machines without requiring an external KMS solution. When enabling this feature, a backup must be taken, which is a PKCS#12 formatted file. If no password is provided during the backup process, this presents the opportunity for this to be used maliciously and compromise the environment.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

From the vSphere Client, go to Host and Clusters.

Select a vCenter Server >> Configure >> Security >> Key Providers.

Select the Native Key Provider, click "Back-up", and check the box "Protect Native Key Provider data with password".

Provide a strong password and click "Back up key provider".

Delete any previous backups that were not protected with a password.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_8-0_Y26M07_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-258960r1051428_rule, STIG-ID|VCSA-80-000294, Vuln-ID|V-258960

Plugin: VMware

Control ID: 9af94893cbbf190c7252d67e25ceaecc86eb27b0272e8d830794d1e6d8b14a0f