STIGQter: STIG Summary: VMware vSphere 7.0 ESXi Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 02 Apr 2025:

Remote logging for ESXi hosts must be configured.

DISA Rule

SV-256378r958406_rule

Vulnerability Number

V-256378

Group Title

SRG-OS-000032-VMM-000130

Rule Version

ESXI-70-000004

Severity

CAT II

CCI(s)

• CCI-000067 - Employ automated mechanisms to monitor remote access methods.
• CCI-000154 - Provide the capability to centrally review and analyze audit records from multiple components within the system.
• CCI-000163 - Protect audit information from unauthorized modification.
• CCI-000164 - Protect audit information from unauthorized deletion.
• CCI-001851 - Transfer audit logs per organization-defined frequency to a different system, system component, or media than the system or system component conducting the logging.

Weight

10

Fix Recommendation

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Advanced System Settings.

Click "Edit". Select the "Syslog.global.logHost" value and configure it to a site-specific syslog server.

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name Syslog.global.logHost | Set-AdvancedSetting -Value "<syslog server hostname>"

Check Contents

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Advanced System Settings.

Select the "Syslog.global.logHost" value and verify it is set to a site-specific syslog server.

Follow the conventions shown below:

udp://<IP/FQDN>:514
tcp://<IP/FQDN>:514
ssl://<IP/FQDN>:1514

Multiple servers can be specified when separated by commas.

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name Syslog.global.logHost

If the "Syslog.global.logHost" setting is not set to a valid, site-specific syslog server, this is a finding.

Vulnerability Number

V-256378

Documentable

False

Rule Version

ESXI-70-000004

Severity Override Guidance

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Advanced System Settings.

Select the "Syslog.global.logHost" value and verify it is set to a site-specific syslog server.

Follow the conventions shown below:

udp://<IP/FQDN>:514
tcp://<IP/FQDN>:514
ssl://<IP/FQDN>:1514

Multiple servers can be specified when separated by commas.

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name Syslog.global.logHost

If the "Syslog.global.logHost" setting is not set to a valid, site-specific syslog server, this is a finding.

Check Content Reference

M

Target Key

5518