VCFL-67-000001 – vSphere Client must limit the amount of time that each TCP connection is kept alive.
Details Denial of service (DoS) is one threat against web servers. Many DoS attacks attempt to consume web server resources...
- Home
- Security Hardening
- DISA STIG VMware vSphere 6.7 Virgo Client V1R1
DISA STIG VMware vSphere 6.7 Virgo Client V1R1
VCFL-67-000002 – vSphere Client must limit the number of concurrent connections permitted.
Details Resource exhaustion can occur when an unlimited number of concurrent requests are allowed on a website, facilitating a denial-of-service...VCFL-67-000003 – vSphere Client must limit the maximum size of a POST request.
Details The ‘maxPostSize’ value is the maximum size in bytes of the POST that will be handled by the container...VCFL-67-000004 – vSphere Client must protect cookies from XSS.
Details Cookies are a common way to save session state over the HTTP(S) protocol. If an attacker can compromise session...VCFL-67-000005 – vSphere Client must be configured with FIPS 140-2 compliant ciphers for HTTPS connections.
Details Encryption of data in flight is an essential element of protecting information confidentiality. If a web server uses weak...VCFL-67-000006 – vSphere Client must be configured to enable SSL/TLS.
Details Data exchanged between the user and the web server can range from static display data to credentials used to...VCFL-67-000007 – vSphere Client must be configured to only communicate over TLS 1.2.
Details Data exchanged between the user and the web server can range from static display data to credentials used to...VCFL-67-000008 – vSphere Client must be configured to use the HTTPS scheme.
Details Data exchanged between the user and the web server can range from static display data to credentials used to...VCFL-67-000017 – vSphere Client must not have any symbolic links in the web content directory tree.
Details A web server is designed to deliver content and execute scripts or applications on the request of a client...VCFL-67-000018 – vSphere Client must ensure appropriate permissions are set on the keystore.
Details The web server’s private key is used to prove the identity of the server to clients and securely exchange...