Check: VCTR-67-000055
VMware vSphere 6.7 vCenter STIG:
VCTR-67-000055
(in versions v1 r4 through v1 r1)
Title
The vCenter Server must configure the vSAN Datastore name to a unique name. (Cat II impact)
Discussion
A vSAN Datastore name by default is "vsanDatastore". If more than one vSAN cluster is present in vCenter, both datastores will have the same name by default, potentially leading to confusion and manually misplaced workloads.
Check Content
If no clusters are enabled for vSAN, this is not applicable. From the vSphere Client, go to Hosts and Clusters >> select a vSAN Enabled Cluster >> Datastores. Review the datastores. Identify any datastores with "vSAN" as the datastore type. or From a PowerCLI command prompt while connected to the vCenter server, run the following command: If($(Get-Cluster | where {$_.VsanEnabled} | Measure).Count -gt 0){ Write-Host "vSAN Enabled Cluster found" Get-Cluster | where {$_.VsanEnabled} | Get-Datastore | where {$_.type -match "vsan"} } else{ Write-Host "vSAN is not enabled, this finding is not applicable" } If vSAN is enabled and the datastore is named "vsanDatastore", this is a finding.
Fix Text
From the vSphere Client, go to Hosts and Clusters >> select a vSAN Enabled Cluster >> Datastores. Right-click on the datastore named "vsanDatastore" and select "Rename". Rename the datastore based on site-specific naming standards. or From a PowerCLI command prompt while connected to the vCenter server, run the following command: If($(Get-Cluster | where {$_.VsanEnabled} | Measure).Count -gt 0){ Write-Host "vSAN Enabled Cluster found" $Clusters = Get-Cluster | where {$_.VsanEnabled} Foreach ($clus in $clusters){ $clus | Get-Datastore | where {$_.type -match "vsan"} | Set-Datastore -Name $(($clus.name) + "_vSAN_Datastore") } } else{ Write-Host "vSAN is not enabled, this finding is not applicable" }
Additional Identifiers
Rule ID: SV-243111r879887_rule
Vulnerability ID: V-243111
Group Title: SRG-APP-000516
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000366 |
The organization implements the security configuration settings. |
Controls
Number | Title |
---|---|
CM-6 |
Configuration Settings |