STIGQter: STIG Summary: VMware vSphere 8.0 ESXi Security Technical Implementation Guide Version: 2 Release: 4 Benchmark Date: 01 Jul 2026:

The ESXi host Secure Shell (SSH) daemon must ignore .rhosts files.

DISA Rule

SV-258738r1015920_rule

Vulnerability Number

V-258738

Group Title

SRG-OS-000107-VMM-000530

Rule Version

ESXI-80-000052

Severity

CAT II

CCI(s)

• CCI-000765 - Implement multifactor authentication for network access to privileged accounts.

Weight

10

Fix Recommendation

From an ESXi shell, run the following command:

# esxcli system ssh server config set -k ignorerhosts -v yes

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$arguments = $esxcli.system.ssh.server.config.set.CreateArgs()
$arguments.keyword = 'ignorerhosts'
$arguments.value = 'yes'
$esxcli.system.ssh.server.config.set.Invoke($arguments)

Check Contents

From an ESXi shell, run the following command:

# esxcli system ssh server config list -k ignorerhosts

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$esxcli.system.ssh.server.config.list.invoke() | Where-Object {$_.Key -eq 'ignorerhosts'}

Example result:

ignorerhosts yes

If "ignorerhosts" is not configured to "yes", this is a finding.

Vulnerability Number

V-258738

Documentable

False

Rule Version

ESXI-80-000052

Severity Override Guidance

From an ESXi shell, run the following command:

# esxcli system ssh server config list -k ignorerhosts

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$esxcli.system.ssh.server.config.list.invoke() | Where-Object {$_.Key -eq 'ignorerhosts'}

Example result:

ignorerhosts yes

If "ignorerhosts" is not configured to "yes", this is a finding.

Check Content Reference

M

Target Key

5562