[ Applies to ] StorageGuard / VAST Data / AI Storage & Parallel File Storage
This article lists the recommended baseline checks for VAST Data. Core6 updates the list periodically as new StorageGuard checks become available.
In this article
Overview
VAST Data clusters are a scale-out, all-flash platform for AI, analytics and large-scale unstructured data, commonly deployed alongside NVIDIA-accelerated compute. A disaggregated, shared-everything architecture combines stateless compute nodes with NVMe flash to deliver a global namespace for file, object and block workloads.
Why hardening VAST Data matters
VAST clusters frequently hold AI training data and intellectual property. Role-based access, encryption at rest and in transit, indestructible snapshots and comprehensive auditing protect that data's confidentiality, integrity and availability, and StorageGuard continuously validates these settings across the cluster and VMS.
Recommended baseline checks
The baseline below contains 97 checks, listed alphabetically.
| ID | Configuration check | Component |
|---|---|---|
| SG-M4255T246V01 | ABAC Attribute Configuration | Cluster |
| SG-C0393T249V01 | Account lockout threshold | VMS |
| SG-M5930T246V01 | Anonymous Access | Cluster |
| SG-C0163T246V01 | Approved AD domain | Cluster |
| SG-C0449T246V01 | Approved DNS servers | Cluster |
| SG-C0449T249V01 | Approved DNS servers | VMS |
| SG-C0044T246V01 | Approved KMS server | Cluster |
| SG-C0013T249V01 | Approved NTP servers | VMS |
| SG-C0400T246V01 | Approved SMTP recipients | Cluster |
| SG-C0406T246V01 | Approved SMTP server | Cluster |
| SG-C0314T246V01 | Approved SMTP user | Cluster |
| SG-C0015T246V01 | Approved Syslog servers | Cluster |
| SG-M8045T246V01 | Assigned Realms and Permissions | Cluster |
| SG-C0331T246V02 | Audit log file retention | Cluster |
| SG-C0331T246V01 | Audit log retention - audit file | Cluster |
| SG-C0023T246V01 | Bucket versioning status | Cluster |
| SG-M3246T246V01 | Call Home SSL Verification | Cluster |
| SG-C0029T246V01 | Centralized log server | Cluster |
| SG-C0233T246V01 | Centralized log server redundancy | Cluster |
| SG-M6963T246V01 | Certificate Issuer | Cluster |
| SG-C0197T246V01 | Client IP ACL | Cluster |
| SG-M3108T246V01 | Client IP ACL (Clients with Access) | Cluster |
| SG-M5255T246V01 | Cloud Call Home Service Status | Cluster |
| SG-C0369T246V01 | Cross origin resource sharing (CORS) status | Cluster |
| SG-C0065T246V01 | Data at-rest encryption | Cluster |
| SG-C0056T246V01 | Default passwords | Cluster |
| SG-M1540T246V01 | Disable unused services | Cluster |
| SG-C0243T246V01 | DNS server configuration (Cluster) | Cluster |
| SG-C0243T249V01 | DNS server configuration (VMS) | VMS |
| SG-C0060T246V01 | DNS server redundancy | Cluster |
| SG-C0060T249V01 | DNS server redundancy | VMS |
| SG-M1589T246V01 | Encrypted Paths for Sensitive Views | Cluster |
| SG-M6391T246V01 | Encryption Key Management Method | Cluster |
| SG-M1988T246V01 | Encryption Key Rotation | Cluster |
| SG-C0175T246V01 | Event types enabled for audit logging | Cluster |
| SG-M4099T246V01 | Event Types Enabled for Audit Logging — Protocol Audit | Cluster |
| SG-C0175T246V02 | Event types enabled for syslog | Cluster |
| SG-C0037T246V01 | Identity provider configuration (AD FS) -SAML | Cluster |
| SG-C0209T246V01 | Idle session timeout | Cluster |
| SG-M6278T246V01 | Indestructibility Mode | Cluster |
| SG-M5563T246V01 | Indestructible Protection Policy | Cluster |
| SG-C0049T246V01 | KMS server configuration | Cluster |
| SG-C0052T246V01 | KMS server redundancy | Cluster |
| SG-C0120T246V01 | LDAP incorrect role mapping | Cluster |
| SG-M4545T246V01 | Local KMS Server Used | Cluster |
| SG-C0427T249V01 | Login banner message | VMS |
| SG-C0426T249V01 | Login banner status | VMS |
| SG-M2054T246V01 | Maximum API Tokens per User | Cluster |
| SG-C0234T249V01 | Maximum password age | VMS |
| SG-C0262T249V01 | Minimum password age | VMS |
| SG-C0270T249V01 | Minimum password digits | VMS |
| SG-C0264T249V01 | Minimum password length | VMS |
| SG-C0271T249V01 | Minimum password lowercase characters | VMS |
| SG-C0272T249V01 | Minimum password special characters | VMS |
| SG-C0273T249V01 | Minimum password uppercase characters | VMS |
| SG-M4618T246V01 | Minimum Password Uppercase/Lowercase/Special/Digits Characters | Cluster |
| SG-M7640T246V01 | MOTD / Banner Status | Cluster |
| SG-C0428T246V01 | MOTD message | Cluster |
| SG-C0423T246V01 | MOTD status | Cluster |
| SG-C0191T246V01 | NFS export ACL status | Cluster |
| SG-M9026T246V01 | NFS Root Squash | Cluster |
| SG-C0121T246V01 | NFS versions enabled | Cluster |
| SG-M2576T246V01 | NFS Versions Enabled (View) | Cluster |
| SG-M2012T246V01 | Non-Default (Unapproved) Local Users | Cluster |
| SG-C0231T246V01 | Non-default local users | Cluster |
| SG-M8699T246V01 | NTLM Status | Cluster |
| SG-C0171T249V01 | NTP server configuration | VMS |
| SG-C0432T249V01 | NTP server redundancy | VMS |
| SG-C0284T249V01 | Password history | VMS |
| SG-C0397T246V01 | Remote support configuration | Cluster |
| SG-C0138T246V01 | Remote support status | Cluster |
| SG-C0398T246V01 | Remote support via proxy | Cluster |
| SG-C0091T246V01 | Replication link encryption | Cluster |
| SG-C0450T246V01 | Required DNS servers | Cluster |
| SG-C0450T249V01 | Required DNS servers | VMS |
| SG-C0051T246V01 | Required KMS server | Cluster |
| SG-C0014T249V01 | Required NTP servers | VMS |
| SG-C0016T246V01 | Required Syslog servers | Cluster |
| SG-M7185T246V01 | Restricted View Policy | Cluster |
| SG-M7880T246V01 | S3 Anonymous Access | Cluster |
| SG-M6790T246V01 | Secure S3 Replication | Cluster |
| SG-C0364T246V01 | SMTP security | Cluster |
| SG-C0395T246V01 | SMTP server configuration | Cluster |
| SG-M3960T246V01 | Strong Cipher Suites Configured | Cluster |
| SG-C0306T246V01 | Syslog communication protocol | Cluster |
| SG-C0019T249V02 | Target build (VMS) | VMS |
| SG-C0019T249V01 | Target OS version (VMS) | VMS |
| SG-C0043T246V01 | Tenant authentication services | Cluster |
| SG-M5468T246V01 | Tenant Client IP Restrictions | Cluster |
| SG-C0232T246V01 | Tenant local user authentication | Cluster |
| SG-C0121T246V02 | Tenant NFSv4.2 status | Cluster |
| SG-M6266T246V01 | TLS Enabled for VMS API | Cluster |
| SG-C0390T249V01 | TLS level | VMS |
| SG-M5428T246V01 | Unrestricted Cluster Privilege | Cluster |
| SG-M5095T246V01 | Use of Secure AD | Cluster |
| SG-C0213T246V01 | Use of secure LDAP | Cluster |
| SG-C0213T246V02 | Use of secure LDAP (AD) | Cluster |
Related components
A complete baseline also covers the components that manage, connect to or protect VAST Data. Review the configuration of:
- VAST Management Server (VMS)
- Protocol clients and S3 applications
- Replication peers
Run checks with StorageGuard
Want automated validation? StorageGuard continuously scans VAST Data against a baseline and reports misconfigurations, with remediation guidance. Contact us to see it in your environment, or learn more about StorageGuard.
[ Still need help? ]
Our support team is here to help. Submit a request.
Comments
0 comments
Please sign in to leave a comment.