Detections
Analytics

VCWN-65-000061 - The vCenter Server for Windows must disable Password and Windows integrated authentication.

Information

All forms of authentication other than CAC must be disabled. Password authentication can be temporarily re-enabled for emergency access to the local SSO domain accounts but it must be disable as soon as CAC authentication is functional.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

1. Login to the Platform Services Controller web interface with [email protected] from

https://<FQDN or IP of PSC>/psc

In an embedded deployment the Platform Services Controller host name or IP address is the same as the vCenter Server host name or IP address.

If you specified a different SSO domain during installation, log in as administrator@<mydomain>.

2. Browse to Single Sign-On >> Configuration.

3. Click the 'Smart Card Configuration' tab, click the 'Edit' button next to 'Authentication Configuration'.

4. Check the box next to 'Password and Windows session authentication'. Click 'OK'.

To re-enable password authentication for troubleshooting run the following command from the PSC:

/opt/vmware/bin/sso-config.sh -set_authn_policy -pwdAuthn true -winAuthn false -certAuthn false -securIDAuthn false -t vsphere.local

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-5_Y23M07_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|III, CCI|CCI-000366, Rule-ID|SV-216880r879887_rule, STIG-ID|VCWN-65-000061, STIG-Legacy|SV-104655, STIG-Legacy|V-94825, Vuln-ID|V-216880

Plugin: VMware

Control ID: d65375d70755620b889df2aecd556bdbd88b652297069be980705fa765aff71a