STIGQter: STIG Summary: VMware vSphere 6.7 ESXi Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 09 Mar 2021:

Access to the ESXi host must be limited by enabling Lockdown Mode.

DISA Rule

SV-239258r674703_rule

Vulnerability Number

V-239258

Group Title

SRG-OS-000027-VMM-000080

Rule Version

ESXI-67-000001

Severity

CAT II

CCI(s)

• CCI-000054 - The information system limits the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number of sessions.
• CCI-001682 - The information system automatically removes or disables emergency accounts after an organization-defined time period for each type of account.

Weight

10

Fix Recommendation

From the vSphere Client, select the ESXi host and go to Configure >> System >> Security Profile.

Click "Edit" in "Lockdown Mode" and enable ("Normal" or "Strict").

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$level = "lockdownNormal" OR "lockdownStrict"
$vmhost = Get-VMHost -Name <hostname> | Get-View
$lockdown = Get-View $vmhost.ConfigManager.HostAccessManager
$lockdown.ChangeLockdownMode($level)

Note: In Strict Lockdown Mode, the DCUI service is stopped. If the connection to vCenter Server is lost and the vSphere Client is no longer available, the ESXi host becomes inaccessible.

Check Contents

From the vSphere Client, select the ESXi host and go to Configure >> System >> Security Profile.

Scroll down to "Lockdown Mode" and verify it is enabled ("Normal" or "Strict").

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Select Name,@{N="Lockdown";E={$_.Extensiondata.Config.LockdownMode}}

If Lockdown Mode is disabled, this is a finding.

For environments that do not use vCenter server to manage ESXi, this is Not Applicable.

Vulnerability Number

V-239258

Documentable

False

Rule Version

ESXI-67-000001

Severity Override Guidance

From the vSphere Client, select the ESXi host and go to Configure >> System >> Security Profile.

Scroll down to "Lockdown Mode" and verify it is enabled ("Normal" or "Strict").

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Select Name,@{N="Lockdown";E={$_.Extensiondata.Config.LockdownMode}}

If Lockdown Mode is disabled, this is a finding.

For environments that do not use vCenter server to manage ESXi, this is Not Applicable.

Check Content Reference

M

Target Key

5326

Comments