Check: VCRP-67-000008
VMware vSphere 6.7 RhttpProxy STIG:
VCRP-67-000008
(in versions v1 r3 through v1 r1)
Title
The rhttproxy must exclusively use the HTTPS protocol for client connections. (Cat II impact)
Discussion
Remotely accessing vCenter via the rhttpproxy involves sensitive information going over the wire. To protect the confidentiality and integrity of these communications, the rhttpproxy must be configured to use an encrypted session of HTTPS rather than plain-text HTTP. The SSL configuration block inside the rhttproxy configuration must be present and configured correctly to safely enable TLS.
Check Content
At the command prompt, execute the following command: # xmllint --xpath '/config/ssl' /etc/vmware-rhttpproxy/config.xml Expected result: <ssl> <!-- The server private key file --> <privateKey>/etc/vmware-rhttpproxy/ssl/rui.key</privateKey> <!-- The server side certificate file --> <certificate>/etc/vmware-rhttpproxy/ssl/rui.crt</certificate> <!-- vecs server name. Currently vecs runs on all node types. --> <vecsServerName>localhost</vecsServerName> </ssl> If the output does not match the expected result, this is a finding.
Fix Text
Navigate to and open /etc/vmware-rhttpproxy/config.xml. Locate the first <ssl> block and set its content to the following: <ssl> <!-- The server private key file --> <privateKey>/etc/vmware-rhttpproxy/ssl/rui.key</privateKey> <!-- The server side certificate file --> <certificate>/etc/vmware-rhttpproxy/ssl/rui.crt</certificate> <!-- vecs server name. Currently vecs runs on all node types. --> <vecsServerName>localhost</vecsServerName> </ssl> Restart the service for changes to take effect. # vmon-cli --restart rhttpproxy
Additional Identifiers
Rule ID: SV-240723r879692_rule
Vulnerability ID: V-240723
Group Title: SRG-APP-000315-WSR-000003
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-002314 |
The information system controls remote access methods. |
Controls
Number | Title |
---|---|
AC-17 (1) |
Automated Monitoring / Control |