STIGQter STIGQter: STIG Summary: VMware ESXi Version 5 Virtual Machine Security Technical Implementation Guide Version: 1 Release: 7 Benchmark Date: 28 Jul 2017: The system must disconnect unauthorized USB devices.

DISA Rule

SV-51351r2_rule

Vulnerability Number

V-39493

Group Title

ESXi5-237

Rule Version

ESXI5-VM-000038

Severity

CAT II

CCI(s)

Weight

10

Fix Recommendation

If USB is required, no fix is required.

Configure the VM with the correct "<keyword> = <keyval>" pair.

To edit a powered-down virtual machine's .vmx file, first remove it from vCenter Server's inventory. Manual additions to the .vmx file from ESXi will be overwritten by any registered entries stored in the vCenter Server database. Make a backup copy of the .vmx file. If the edit breaks the virtual machine, it can be rolled back to the original version of the file.

Open the vSphere/VMware Infrastructure (VI) Client and log in with appropriate credentials.
If connecting to vCenter Server, click on the desired host.
Click the Configuration tab.
Click Storage.
Right-click on the appropriate datastore and click Browse Datastore.
Navigate to the folder named after the virtual machine, and locate the <virtual machine>.vmx file.
Right-click the .vmx file and click Remove from inventory.

Temporarily disable Lockdown Mode and enable the ESXi Shell via the vSphere Client.

Open the vSphere/VMware Infrastructure (VI) Client and log in with appropriate credentials.
If connecting to vCenter Server, click on the desired host.
Click the Configuration tab.
Click Software, Security Profile, Services, Properties, ESXi Shell, and Options, respectively.
Start the ESXi Shell service, where/as required.

As root, log in to the ESXi host and locate the VM's vmx file.
# find / | grep vmx

Add the following to the VM's vmx file.
keyword = "keyval"

Where:
keyword = usb.present
keyval = FALSE

Re-enable Lockdown Mode on the host.

Re-register the VM with the vCenter Server:
Open the vSphere/VMware Infrastructure (VI) Client and log in with appropriate credentials.
If connecting to vCenter Server, click on the desired host.
Click the Configuration tab.
Click Storage.
Right-click on the appropriate datastore and click Browse Datastore.
Navigate to the folder named after the virtual machine, and locate the <virtual machine>.vmx file.
Right-click the .vmx file and click Add to inventory. The Add to Inventory wizard opens.
Continue to follow the wizard to add the virtual machine.

Check Contents

If USB is required, this check is not applicable.

Temporarily disable Lockdown Mode and enable the ESXi Shell via the vSphere Client.

Open the vSphere/VMware Infrastructure (VI) Client and log in with appropriate credentials.
If connecting to vCenter Server, click on the desired host.
Click the Configuration tab.
Click Software, Security Profile, Services, Properties, ESXi Shell, and Options, respectively.
Start the ESXi Shell service, where/as required.

As root, log in to the ESXi Shell and locate the VM's vmx file.
# find / | grep vmx

Check the VM's ".vmx" file for the correct "<keyword> = <keyval>" pair.
keyword = usb.present
keyval = FALSE
# grep "^<keyword>" <the VM's vmx file>

If the usb.present keyval is set to "TRUE", this is a finding.

Re-enable Lockdown Mode on the host.

Vulnerability Number

V-39493

Documentable

False

Rule Version

ESXI5-VM-000038

Severity Override Guidance

If USB is required, this check is not applicable.

Temporarily disable Lockdown Mode and enable the ESXi Shell via the vSphere Client.

Open the vSphere/VMware Infrastructure (VI) Client and log in with appropriate credentials.
If connecting to vCenter Server, click on the desired host.
Click the Configuration tab.
Click Software, Security Profile, Services, Properties, ESXi Shell, and Options, respectively.
Start the ESXi Shell service, where/as required.

As root, log in to the ESXi Shell and locate the VM's vmx file.
# find / | grep vmx

Check the VM's ".vmx" file for the correct "<keyword> = <keyval>" pair.
keyword = usb.present
keyval = FALSE
# grep "^<keyword>" <the VM's vmx file>

If the usb.present keyval is set to "TRUE", this is a finding.

Re-enable Lockdown Mode on the host.

Check Content Reference

M

Target Key

2438

Comments