STIGQter: STIG Summary: VMware vSphere 7.0 ESXi Security Technical Implementation Guide Version: 1 Release: 4 Benchmark Date: 02 Apr 2025:

The ESXi host SSH daemon must be configured with the DOD logon banner.

DISA Rule

SV-256383r958390_rule

Vulnerability Number

V-256383

Group Title

SRG-OS-000023-VMM-000060

Rule Version

ESXI-70-000009

Severity

CAT II

CCI(s)

• CCI-000048 - Display an organization-defined system use notification message or banner to users before granting access to the system that provides privacy and security notices consistent with applicable federal laws, Executive Orders, directives, policies, regulations, standards, and guidelines.

Weight

10

Fix Recommendation

From an ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":

Banner /etc/issue

Check Contents

From an ESXi shell, run the following command:

# /usr/lib/vmware/openssh/bin/sshd -T|grep banner

Expected result:

banner /etc/issue

If the output does not match the expected result, this is a finding.

Vulnerability Number

V-256383

Documentable

False

Rule Version

ESXI-70-000009

Severity Override Guidance

From an ESXi shell, run the following command:

# /usr/lib/vmware/openssh/bin/sshd -T|grep banner

Expected result:

banner /etc/issue

If the output does not match the expected result, this is a finding.

Check Content Reference

M

Target Key

5518