Check: VCTR-67-000054
VMware vSphere 6.7 vCenter STIG:
VCTR-67-000054
(in versions v1 r4 through v1 r1)
Title
The vCenter Server must disable or restrict the connectivity between vSAN Health Check and public Hardware Compatibility List by use of an external proxy server. (Cat II impact)
Discussion
The vSAN Health Check is able to download the hardware compatibility list from VMware to check compliance against the underlying vSAN Cluster hosts. To ensure the vCenter server is not directly downloading content from the internet, this functionality must be disabled or, if this feature is necessary, an external proxy server must be configured.
Check Content
If no clusters are enabled for vSAN, this is not applicable. From the vSphere Client, go to Hosts and Clusters >> select the vCenter Server >> Configure >> vSAN >> Internet Connectivity. If the HCL internet download is not required, verify that "Status" is disabled. If the "Status" is enabled, this is a finding. If the HCL internet download is required, verify that "Status" is enabled and a proxy host is configured. If "Status" is enabled and a proxy is not configured, this is a finding.
Fix Text
From the vSphere Client, go to Hosts and Clusters >> vCenter Server >> Configure >> vSAN >> Internet Connectivity >> Edit. If the HCL internet download is not required, ensure that "Status" is disabled. If the HCL internet download is required, ensure that "Status" is enabled and a proxy host is appropriately configured.
Additional Identifiers
Rule ID: SV-243110r879887_rule
Vulnerability ID: V-243110
Group Title: SRG-APP-000516
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000366 |
The organization implements the security configuration settings. |
Controls
Number | Title |
---|---|
CM-6 |
Configuration Settings |