STIGQter: STIG Summary: VMware vSphere 8.0 ESXi Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 31 Oct 2023:

The ESXi host must enable lockdown mode.

DISA Rule

SV-258730r933251_rule

Vulnerability Number

V-258730

Group Title

SRG-OS-000027-VMM-000080

Rule Version

ESXI-80-000008

Severity

CAT II

CCI(s)

• CCI-000054 - Limit the number of concurrent sessions for each organization-defined account and/or account type to an organization-defined number.

Weight

10

Fix Recommendation

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Security Profile >> Lockdown Mode.

Click edit and select either the "Normal" or "Strict" radio buttons.

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$level = "lockdownNormal" OR "lockdownStrict"
$vmhost = Get-VMHost -Name <hostname> | Get-View
$lockdown = Get-View $vmhost.ConfigManager.HostAccessManager
$lockdown.ChangeLockdownMode($level)

Note: In strict lockdown mode, the Direct Console User Interface (DCUI) service is stopped. If the connection to vCenter Server is lost and the vSphere Client is no longer available, the ESXi host becomes inaccessible.

Check Contents

For environments that do not use vCenter server to manage ESXi, this is not applicable.

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Security Profile.

Scroll down to "Lockdown Mode" and verify it is set to "Enabled" (Normal or Strict).

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Select Name,@{N="Lockdown";E={$_.Extensiondata.Config.LockdownMode}}

If "Lockdown Mode" is disabled, this is a finding.

Vulnerability Number

V-258730

Documentable

False

Rule Version

ESXI-80-000008

Severity Override Guidance

For environments that do not use vCenter server to manage ESXi, this is not applicable.

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Security Profile.

Scroll down to "Lockdown Mode" and verify it is set to "Enabled" (Normal or Strict).

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Select Name,@{N="Lockdown";E={$_.Extensiondata.Config.LockdownMode}}

If "Lockdown Mode" is disabled, this is a finding.

Check Content Reference

M

Target Key

5562