VMware vSphere 8.0 vCenter Appliance User Interface (UI) Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-APP-000251-AS-000165
Group -
SRG-APP-000266-AS-000169
Group -
The vCenter UI service "ErrorReportValve showServerInfo" must be set to "false".
The Error Report Valve is a simple error handler for HTTP status codes that will generate and return HTML error pages. It can also be configured to return predefined static HTML pages for specific ...Rule Medium Severity -
SRG-APP-000295-AS-000263
Group -
SRG-APP-000358-AS-000064
Group -
The vCenter UI service must offload log records onto a different system or media from the system being logged.
Information system logging capability is critical for accurate forensic analysis. Log record content that may be necessary to satisfy the requirement of this control includes, but is not limited to...Rule Medium Severity -
SRG-APP-000516-AS-000237
Group -
The vCenter UI service must enable "STRICT_SERVLET_COMPLIANCE".
Strict Servlet Compliance forces Tomcat to adhere to standards specifications including but not limited to RFC2109. RFC2109 sets the standard for HTTP session management. This setting affects sever...Rule Medium Severity -
SRG-APP-000001-AS-000001
Group -
SRG-APP-000001-AS-000001
Group -
The vCenter UI service must limit the number of times that each Transmission Control Protocol (TCP) connection is kept alive.
KeepAlive provides long lived HTTP sessions that allow multiple requests to be sent over the same connection. Enabling KeepAlive mitigates the effects of several types of denial-of-service attacks....Rule Medium Severity -
SRG-APP-000251-AS-000165
Group -
The vCenter UI service must configure the "setCharacterEncodingFilter" filter.
Invalid user input occurs when a user inserts data or characters into a hosted application's data entry field and the hosted application is unprepared to process that data. This results in unantici...Rule Medium Severity -
SRG-APP-000033-AS-000024
Group -
The vCenter UI service cookies must have "http-only" flag set.
Cookies are a common way to save session state over the HTTP(S) protocol. If attackers can compromise session data stored in a cookie, they are better able to launch an attack against the server an...Rule Medium Severity -
SRG-APP-000033-AS-000024
Group -
The vCenter UI service DefaultServlet must be set to "readonly" for "PUT" and "DELETE" commands.
The default servlet (or DefaultServlet) is a special servlet provided with Tomcat that is called when no other suitable page is found in a particular folder. The DefaultServlet serves static resour...Rule Medium Severity -
SRG-APP-000141-AS-000095
Group -
SRG-APP-000141-AS-000095
Group -
SRG-APP-000141-AS-000095
Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.