VAMI must implement Transport Layer Security (TLS) 1.2 exclusively.

Severity	Group ID	Group Title	Version	Rule ID	Date	STIG Version
medium	V-256668	SRG-APP-000439-WSR-000156	VCLD-70-000024	SV-256668r888526_rule	2023-06-15	1

Description
TLS is a required transmission protocol for a web server hosting controlled information. The use of TLS provides confidentiality of data in transit between the web server and client. FIPS 140-2 approved TLS versions must be enabled, and non-FIPS-approved Secure Sockets Layer (SSL) versions must be disabled. VAMI comes configured to use only TLS 1.2. This configuration must be verified and maintained. Satisfies: SRG-APP-000439-WSR-000156, SRG-APP-000442-WSR-000182

Description

TLS is a required transmission protocol for a web server hosting controlled information. The use of TLS provides confidentiality of data in transit between the web server and client. FIPS 140-2 approved TLS versions must be enabled, and non-FIPS-approved Secure Sockets Layer (SSL) versions must be disabled. VAMI comes configured to use only TLS 1.2. This configuration must be verified and maintained. Satisfies: SRG-APP-000439-WSR-000156, SRG-APP-000442-WSR-000182

ℹ️ Check
At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2>/dev/null\|grep "ssl.use"\|sed 's: ::g' Expected result: ssl.use-sslv2="disable" ssl.use-sslv3="disable" ssl.use-tlsv10="disable" ssl.use-tlsv11="disable" ssl.use-tlsv12="enable" If the output does not match the expected result, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

ℹ️ Check

At the command prompt, run the following command: # /opt/vmware/sbin/vami-lighttpd -p -f /opt/vmware/etc/lighttpd/lighttpd.conf 2>/dev/null|grep "ssl.use"|sed 's: ::g' Expected result: ssl.use-sslv2="disable" ssl.use-sslv3="disable" ssl.use-tlsv10="disable" ssl.use-tlsv11="disable" ssl.use-tlsv12="enable" If the output does not match the expected result, this is a finding. Note: The command must be run from a bash shell and not from a shell generated by the "appliance shell". Use the "chsh" command to change the shell for the account to "/bin/bash". Refer to KB Article 2100508 for more details: https://kb.vmware.com/s/article/2100508

✔️ Fix
Navigate to and open: /opt/vmware/etc/lighttpd/lighttpd.conf Replace all "ssl.use-*" lines with the following: ssl.use-sslv2="disable" ssl.use-sslv3="disable" ssl.use-tlsv10="disable" ssl.use-tlsv11="disable" ssl.use-tlsv12="enable" Restart the service with the following command: # vmon-cli --restart applmgmt