Adding Strict Transport Security (HSTS) Headers to the vCenter Server Appliance Management Interface (VAMI)
search cancel

Adding Strict Transport Security (HSTS) Headers to the vCenter Server Appliance Management Interface (VAMI)

book

Article ID: 327797

calendar_today

Updated On:

Products

VMware vCenter Server

Issue/Introduction

Customers may receive reports from a security scan that the vCenter Server Appliance Management Interface lacks the Strict Transport Security (HSTS) headers.

Cause

The lighttp daemon does not include these headers by default.

Resolution

  1. Connect to the vCenter Server Appliance via SSH and log in as root.
  2. Back up the current lighttpd configuration file before making any changes:
    • cp /etc/applmgmt/appliance/lighttpd.conf /etc/applmgmt/appliance/lighttpd.conf.bak
  3. Edit the /etc/applmgmt/appliance/lighttpd.conf file using vi.
    • vi /etc/applmgmt/appliance/lighttpd.conf
  4. Locate the following lines:
    • setenv.add-response-header = ( "X-UA-Compatible" => "IE=edge",
                                     "X-Frame-Options" => "Deny" )
  5. Replace them with the following block to include the HSTS header:
    • setenv.add-response-header = ( "X-UA-Compatible" => "IE=edge",
                                     "X-Frame-Options" => "Deny",
                                     "Strict-Transport-Security" => "max-age=31536000; includeSubDomains; preload" )
  6. Save and close the file.
  7. Restart the VAMI lighttpd service to apply the changes:
    • systemctl restart vami-lighttp
Powered by Wolken Software