VMware vSphere 8.0 vCenter Security Technical Implementation Guide

Version: 2

Updated: 07 Aug 2025

Findings: 67

Findings

V-258905 - The vCenter Server must enforce the limit of three consecutive invalid login attempts by a user. (medium)
V-258906 - The vCenter Server must display the Standard Mandatory DOD Notice and Consent Banner before logon. (medium)
V-258907 - The vCenter Server must produce audit records containing information to establish what type of events occurred. (medium)
V-258908 - vCenter Server plugins must be verified. (medium)
V-258909 - The vCenter Server must uniquely identify and authenticate users or processes acting on behalf of users. (medium)
V-258910 - The vCenter Server must require multifactor authentication. (medium)
V-258911 - The vCenter Server passwords must be at least 15 characters in length. (medium)
V-258912 - The vCenter Server must prohibit password reuse for a minimum of five generations. (medium)
V-258913 - The vCenter Server passwords must contain at least one uppercase character. (medium)
V-258914 - The vCenter Server passwords must contain at least one lowercase character. (medium)
V-258915 - The vCenter Server passwords must contain at least one numeric character. (medium)
V-258916 - The vCenter Server passwords must contain at least one special character. (medium)
V-258917 - The vCenter Server must enable FIPS-validated cryptography. (high)
V-258918 - The vCenter Server must enforce a 90-day maximum password lifetime restriction. (medium)
V-258919 - The vCenter Server must enable revocation checking for certificate-based authentication. (medium)
V-258920 - The vCenter Server must terminate vSphere Client sessions after 15 minutes of inactivity. (medium)
V-258921 - The vCenter Server user roles must be verified. (medium)
V-258922 - The vCenter Server must manage excess capacity, bandwidth, or other redundancy to limit the effects of information flooding types of denial-of-service (DoS) attacks by enabling Network I/O Control (NIOC). (medium)
V-258923 - The vCenter Server must provide an immediate real-time alert to the system administrator (SA) and information system security officer (ISSO), at a minimum, on every Single Sign-On (SSO) account action. (medium)
V-258924 - The vCenter Server must set the interval for counting failed login attempts to at least 15 minutes. (medium)
V-258925 - The vCenter Server must be configured to send logs to a central log server. (medium)
V-258926 - The vCenter server must provide an immediate real-time alert to the system administrator (SA) and information system security officer (ISSO), at a minimum, of all audit failure events requiring real-time alerts. (medium)
V-258927 - The vCenter Server must compare internal information system clocks at least every 24 hours with an authoritative time server. (medium)
V-258928 - The vCenter Server Machine Secure Sockets Layer (SSL) certificate must be issued by a DOD certificate authority. (medium)
V-258929 - The vCenter Server must enable data at rest encryption for vSAN. (medium)
V-258930 - The vCenter Server must disable the Customer Experience Improvement Program (CEIP). (medium)
V-258931 - The vCenter server must enforce SNMPv3 security features where SNMP is required. (medium)
V-258932 - The vCenter server must disable SNMPv1/2 receivers. (medium)
V-258933 - The vCenter Server must require an administrator to unlock an account locked due to excessive login failures. (medium)
V-258934 - The vCenter Server must disable the distributed virtual switch health check. (medium)
V-258935 - The vCenter Server must set the distributed port group Forged Transmits policy to "Reject". (medium)
V-258936 - The vCenter Server must set the distributed port group Media Access Control (MAC) Address Change policy to "Reject". (medium)
V-258937 - The vCenter Server must set the distributed port group Promiscuous Mode policy to "Reject". (medium)
V-258938 - The vCenter Server must only send NetFlow traffic to authorized collectors. (medium)
V-258939 - The vCenter Server must configure all port groups to a value other than that of the native virtual local area network (VLAN). (medium)
V-258940 - The vCenter Server must not configure VLAN Trunking unless Virtual Guest Tagging (VGT) is required and authorized. (medium)
V-258941 - The vCenter Server must not configure all port groups to virtual local area network (VLAN) values reserved by upstream physical switches. (medium)
V-258942 - The vCenter Server must configure the "vpxuser" auto-password to be changed every 30 days. (medium)
V-258943 - The vCenter Server must configure the "vpxuser" password to meet length policy. (medium)
V-258944 - The vCenter Server must be isolated from the public internet but must still allow for patch notification and delivery. (low)
V-258945 - The vCenter Server must use unique service accounts when applications connect to vCenter. (medium)
V-258946 - The vCenter Server must protect the confidentiality and integrity of transmitted information by isolating Internet Protocol (IP)-based storage traffic. (medium)
V-258947 - The vCenter server must be configured to send events to a central log server. (medium)
V-258948 - The vCenter Server must disable or restrict the connectivity between vSAN Health Check and public Hardware Compatibility List (HCL) by use of an external proxy server. (medium)
V-258949 - The vCenter Server must configure the vSAN Datastore name to a unique name. (medium)
V-258950 - The vCenter Server must disable Username/Password and Windows Integrated Authentication. (medium)
V-258951 - The vCenter Server must restrict access to the default roles with cryptographic permissions. (medium)
V-258952 - The vCenter Server must restrict access to cryptographic permissions. (medium)
V-258953 - The vCenter Server must have Mutual Challenge Handshake Authentication Protocol (CHAP) configured for vSAN Internet Small Computer System Interface (iSCSI) targets. (medium)
V-258954 - The vCenter Server must have new Key Encryption Keys (KEKs) reissued at regular intervals for vSAN encrypted datastore(s). (medium)
V-258955 - The vCenter Server must use secure Lightweight Directory Access Protocol (LDAPS) when adding an LDAP identity source. (medium)
V-258956 - The vCenter Server must limit membership to the "SystemConfiguration.BashShellAdministrators" Single Sign-On (SSO) group. (medium)
V-258957 - The vCenter Server must limit membership to the "TrustedAdmins" Single Sign-On (SSO) group. (medium)
V-258958 - The vCenter server configuration must be backed up on a regular basis. (medium)
V-258959 - The vCenter server must have task and event retention set to at least 30 days. (medium)
V-258960 - The vCenter server Native Key Provider must be backed up with a strong password. (medium)
V-258961 - The vCenter server must require authentication for published content libraries. (medium)
V-258962 - The vCenter server must enable the OVF security policy for content libraries. (medium)
V-258963 - The vCenter Server must separate authentication and authorization for administrators. (medium)
V-258964 - The vCenter Server must disable CDP/LLDP on distributed switches. (low)
V-258965 - The vCenter Server must remove unauthorized port mirroring sessions on distributed switches. (medium)
V-258966 - The vCenter Server must not override port group settings at the port level on distributed switches. (medium)
V-258967 - The vCenter Server must reset port configuration when virtual machines are disconnected. (medium)
V-258968 - The vCenter Server must disable Secure Shell (SSH) access. (medium)
V-258969 - The vCenter Server must enable data in transit encryption for vSAN. (medium)
V-265978 - The vCenter Server must use DOD-approved encryption to protect the confidentiality of network sessions. (medium)
V-265979 - The vCenter Server must disable accounts used for Integrated Windows Authentication (IWA). (medium)