Check: VMCH-70-000029
VMware vSphere 7.0 Virtual Machine STIG:
VMCH-70-000029
(in versions v1 r2 through v1 r1)
Title
Encryption must be enabled for Fault Tolerance on the virtual machine (VM). (Cat II impact)
Discussion
Fault Tolerance log traffic can be encrypted. This could contain sensitive data from the protected machine's memory or CPU instructions. vSphere Fault Tolerance performs frequent checks between a primary VM and secondary VM so the secondary VM can quickly resume from the last successful checkpoint. The checkpoint contains the VM state that has been modified since the previous checkpoint. When Fault Tolerance is turned on, FT encryption is set to "Opportunistic" by default, which means it enables encryption only if both the primary and secondary host are capable of encryption.
Check Content
If the VM does not have Fault Tolerance enabled, this is not applicable. From the vSphere Client, select the Virtual Machine, right-click, and go to Edit Settings >> VM Options tab >> Encryption >> Encrypted FT. or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following command: Get-VM | Where {($_.ExtensionData.Config.FtEncryptionMode -ne "ftEncryptionOpportunistic") -and ($_.ExtensionData.Config.FtEncryptionMode -ne "ftEncryptionRequired")} If the setting does not have a value of "Opportunistic" or "Required", this is a finding.
Fix Text
From the vSphere Client, select the Virtual Machine, right-click, and go to Edit Settings >> VM Options tab >> Encryption >> FT Encryption. Set the value to "Opportunistic" or "Required". or From a PowerCLI command prompt while connected to the ESXi host or vCenter server, run the following commands: $spec = New-Object VMware.Vim.VirtualMachineConfigSpec $spec.FTEncryption = New-Object VMware.Vim.VMware.Vim.VirtualMachineConfigSpecEncryptedFtModes $spec.FT = ftEncryptionOpportunistic or ftEncryptionRequired (Get-VM -Name <vmname>).ExtensionData.ReconfigVM($spec)
Additional Identifiers
Rule ID: SV-256477r886474_rule
Vulnerability ID: V-256477
Group Title: SRG-OS-000480-VMM-002000
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000366 |
The organization implements the security configuration settings. |
Controls
Number | Title |
---|---|
CM-6 |
Configuration Settings |