The ESXi host rhttpproxy daemon must use FIPS 140-2 validated cryptographic modules to protect the confidentiality of remote access sessions.

An XCCDF Rule

Description

ESXi runs a reverse proxy service called rhttpproxy that front ends internal services and application programming interfaces (APIs) over one HTTPS port by redirecting virtual paths to localhost ports. This proxy implements a FIPS 140-2 validated OpenSSL cryptographic module that is in FIPS mode by default. This configuration must be validated and maintained to protect the traffic that rhttpproxy manages.

ID: SV-256442r958408_rule
Version: ESXI-70-000090
Severity: Medium
References: CCI-000068
Updated: about 2 months ago

Remediation Templates

From an ESXi shell, run the following command:

# esxcli system security fips140 rhttpproxy set -e true

or
From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$arguments = $esxcli.system.security.fips140.rhttpproxy.set.CreateArgs()
$arguments.enable = $true
$esxcli.system.security.fips140.rhttpproxy.set.Invoke($arguments)

The ESXi host rhttpproxy daemon must use FIPS 140-2 validated cryptographic modules to protect the confidentiality of remote access sessions.

Description

Remediation Templates

A Manual Procedure