VMware vSphere 8.0 ESXi Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
SRG-OS-000423-VMM-001700
Group -
SRG-OS-000423-VMM-001700
Group -
The ESXi host must protect the confidentiality and integrity of transmitted information by isolating IP-based storage traffic.
Virtual machines (VMs) might share virtual switches and VLANs with the IP-based storage configurations. IP-based storage includes vSAN, iSCSI, and NFS. This configuration might expose IP-based stor...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
SRG-OS-000480-VMM-002000
Group -
SRG-OS-000480-VMM-002000
Group -
The ESXi host Secure Shell (SSH) daemon must not permit user environment settings.
SSH environment options potentially allow users to bypass access restriction in some configurations. Users must not be able to present environment options to the SSH daemon.Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
SRG-OS-000480-VMM-002000
Group -
The ESXi host Secure Shell (SSH) daemon must not permit tunnels.
OpenSSH has the ability to create network tunnels (layer 2 and layer 3) over an SSH connection. This function can provide similar convenience to a virtual private network (VPN) with the similar ris...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host Secure Shell (SSH) daemon must set a timeout count on idle sessions.
Setting a timeout ensures that a user login will be terminated as soon as the "ClientAliveCountMax" is reached.Rule Low Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host Secure Shell (SSH) daemon must set a timeout interval on idle sessions.
Automatically logging out idle users guards against compromises via hijacked administrative sessions.Rule Low Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must disable Simple Network Management Protocol (SNMP) v1 and v2c.
If SNMP is not being used, it must remain disabled. If it is being used, the proper trap destination must be configured. If SNMP is not properly configured, monitoring information can be sent to a ...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must disable Inter-Virtual Machine (VM) Transparent Page Sharing.
Published academic papers have demonstrated that by forcing a flush and reload of cache memory, it is possible to measure memory timings to try to determine an Advanced Encryption Standard (AES) en...Rule Low Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must configure the firewall to block network traffic by default.
In addition to service-specific firewall rules, ESXi has a default firewall rule policy to allow or deny incoming and outgoing traffic. Reduce the risk of attack by ensuring this is set to deny inc...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must configure virtual switch security policies to reject forged transmits.
If the virtual machine (VM) operating system changes the Media Access Control (MAC) address, the operating system can send frames with an impersonated source MAC address at any time. This allows an...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must configure virtual switch security policies to reject promiscuous mode requests.
When promiscuous mode is enabled for a virtual switch, all virtual machines (VMs) connected to the Portgroup have the potential to read all packets across that network (only the virtual machines co...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must restrict use of the dvFilter network application programming interface (API).
If the organization is not using products that use the dvFilter network API, the host should not be configured to send network information to a virtual machine (VM). If the API is enabled, an atta...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must restrict the use of Virtual Guest Tagging (VGT) on standard switches.
When a port group is set to VLAN 4095, the vSwitch passes all network frames to the attached virtual machines (VMs) without modifying the VLAN tags. In vSphere, this is referred to as VGT. The VM m...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must have all security patches and updates installed.
Installing software updates is a fundamental mitigation against the exploitation of publicly known vulnerabilities.Rule High Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must not suppress warnings that the local or remote shell sessions are enabled.
Warnings that local or remote shell sessions are enabled alert administrators to activity they may not be aware of and need to investigate.Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must verify certificates for SSL syslog endpoints.
When sending syslog data to a remote host, ESXi can be configured to use any combination of TCP, UDP, and SSL transports. When using SSL, the server certificate must be validated to ensure that the...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must configure a session timeout for the vSphere API.
The vSphere API (VIM) allows for remote, programmatic administration of the ESXi host. Authenticated API sessions are no different from a risk perspective than authenticated UI sessions and they ne...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must be configured with an appropriate maximum password age.
The older an ESXi local account password is, the larger the opportunity window is for attackers to guess, crack or reuse a previously cracked password. Rotating passwords on a regular basis is a fu...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi Common Information Model (CIM) service must be disabled.
The CIM system provides an interface that enables hardware-level management from remote applications via a set of standard application programming interfaces (APIs). These APIs are consumed by exte...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
SRG-OS-000480-VMM-002000
Group -
The ESXi host Secure Shell (SSH) daemon must disable port forwarding.
While enabling Transmission Control Protocol (TCP) tunnels is a valuable function of sshd, this feature is not appropriate for use on the ESXi hypervisor.Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host OpenSLP service must be disabled.
OpenSLP implements the Service Location Protocol to help CIM clients discover CIM servers over TCP 427. This service is not widely needed and has had vulnerabilities exposed in the past. To reduce ...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.