Clarity regarding undocumented listening TCP ports on the VMware vCenter Server Appliance (VCSA)
Article ID: 411233
Updated On:
Products
Issue/Introduction
This article answers the following questions a VMware vSphere or VMware Cloud Foundation operator has pertaining to ports "LISTENING" on the VMware vCenter Server Appliance (VCSA).
Scenarios:
Your organization reports the following:
Undocumented listening TCP ports, listening TCP port on the VCSA.
Your organization should see these ports using the following commands:
netstat -anp | grep LISTEN
or
netstat -anp | grep LISTEN | grep <SOME_PORT_NUMBER>
Questions your organization might have:
- What is the Service or process using these ports?
- What is the Description of port use?
- Is this required or can it be disabled, and how to disable if possible?
Environment
VMware vSphere
VMware Cloud Foundation
Cause
Answer:
- These ports do not apply
- None of these ports are logical network accessible ports.
- Yes, they are required.
Details:
Per NERC CIP-007-6 Cyber Security – Systems Security Management,
Reference: https://www.nerc.com/globalassets/standards/reliability-standards/cip/cip-007-6.pdf
Specifically, refer to Page 7, CIP-007-6 Table R1– Ports and Services table
Refer to, Part 1.1, Requirements column, which states:
"Where technically feasible, enable only
logical network accessible ports that
have been determined to be needed by
the Responsible Entity, including port
ranges or services where needed to
handle dynamic ports. If a device has
no provision for disabling or restricting
logical ports on the device then those
ports that are open are deemed
needed."
Per Cyber Security — System Security Management
Technical Rationale and Justification for Reliability Standard CIP-007-7
Refer to Section: Change Rationale Requirement R1 Part 1.1:
"Change Rationale Requirement R1 Part 1.1: Requirement R1 Part 1.1 requires “disable or prevent unneeded routable
protocol network accessibility on each Applicable System, per system capability”. The SDT updated the Requirement
Part language to state a security objective concerning “routable protocol network accessibility” as opposed to “ports
and services”. As this is a new phrase, the intent of this phrase with some examples and rationale for this change is
as follows."
Furthermore, regarding "routable protocol network accessibility":
None of these ports are on network Layer 2 or above and are not logical network accessible ports.
This is easy to confirm by looking at how they are bound only to address 127.0.0.1 (localhost, aka loopback) interface network.
One command which shows this (as root user) is:
netstat -anp | grep LISTEN | grep <SOME_PORT_NUMBER>
Resolution
- These ports do not apply to security audits for "routable protocol network accessibility"
- None of these ports are logical network accessible ports.
- Yes, they are required.
Feedback
