STIGQter: STIG Summary: VMware vSphere 6.5 ESXi Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

The ESXi host must limit the number of concurrent sessions to ten for all accounts and/or account types by enabling lockdown mode.

DISA Rule

SV-207602r378532_rule

Vulnerability Number

V-207602

Group Title

SRG-OS-000027-VMM-000080

Rule Version

ESXI-65-000001

Severity

CAT II

CCI(s)

• CCI-000054 - The information system limits the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number of sessions.

Weight

10

Fix Recommendation

From the vSphere Web Client select the ESXi Host and go to Configure >> System >> Security Profile. Click edit on "Lockdown Mode" and set to Enabled (Normal or Strict).

or

From a PowerCLI command prompt while connected to the ESXi host run the following commands:

$level = "lockdownNormal" OR "lockdownStrict"
$vmhost = Get-VMHost -Name <hostname> | Get-View
$lockdown = Get-View $vmhost.ConfigManager.HostAccessManager
$lockdown.ChangeLockdownMode($level)

Note: In strict lockdown mode the DCUI service is stopped. If the connection to vCenter Server is lost and the vSphere Web Client is no longer available, the ESXi host becomes inaccessible.

Check Contents

From the vSphere Web Client select the ESXi Host and go to Configure >> System >> Security Profile. Scroll down to "Lockdown Mode" and verify it is set to Enabled (Normal or Strict).

or

From a PowerCLI command prompt while connected to the ESXi host run the following command:

Get-VMHost | Select Name,@{N="Lockdown";E={$_.Extensiondata.Config.LockdownMode}}

If Lockdown Mode is disabled, this is a finding.

For environments that do not use vCenter server to manage ESXi, this is not applicable.

Vulnerability Number

V-207602

Documentable

False

Rule Version

ESXI-65-000001

Severity Override Guidance

From the vSphere Web Client select the ESXi Host and go to Configure >> System >> Security Profile. Scroll down to "Lockdown Mode" and verify it is set to Enabled (Normal or Strict).

or

From a PowerCLI command prompt while connected to the ESXi host run the following command:

Get-VMHost | Select Name,@{N="Lockdown";E={$_.Extensiondata.Config.LockdownMode}}

If Lockdown Mode is disabled, this is a finding.

For environments that do not use vCenter server to manage ESXi, this is not applicable.

Check Content Reference

M

Target Key

2925

Comments