STIGQter: STIG Summary: VMware vSphere 6.7 ESXi Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 09 Mar 2021:

The ESXi host must enable Secure Boot.

DISA Rule

SV-239327r674910_rule

Vulnerability Number

V-239327

Group Title

SRG-OS-000480-VMM-002000

Rule Version

ESXI-67-000076

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

Temporarily enable SSH, connect to the ESXi host, and run the following command:

/usr/lib/vmware/secureboot/bin/secureBoot.py -c

If the output indicates that Secure Boot cannot be enabled, correct the discrepancies and try again. If the discrepancies cannot be rectified, this finding is downgraded to a CAT III.

Consult vendor documentation and boot the host into BIOS setup mode. Enable UEFI boot mode and Secure Boot. Restart the host.

Temporarily enable SSH, connect to the ESXi host, and run the following command to verify that Secure Boot is enabled:

/usr/lib/vmware/secureboot/bin/secureBoot.py -s

Check Contents

Temporarily enable SSH, connect to the ESXi host, and run the following command:

/usr/lib/vmware/secureboot/bin/secureBoot.py -s

If the output is not "Enabled", this is a finding.

Vulnerability Number

V-239327

Documentable

False

Rule Version

ESXI-67-000076

Severity Override Guidance

Temporarily enable SSH, connect to the ESXi host, and run the following command:

/usr/lib/vmware/secureboot/bin/secureBoot.py -s

If the output is not "Enabled", this is a finding.

Check Content Reference

M

Target Key

5326

Comments