Skip to content
Log In

VMware vSphere 8.0 ESXi Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host Secure Shell (SSH) daemon must set a timeout count on idle sessions.

    Setting a timeout ensures that a user login will be terminated as soon as the "ClientAliveCountMax" is reached.
    Rule Low Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host Secure Shell (SSH) daemon must set a timeout interval on idle sessions.

    Automatically logging out idle users guards against compromises via hijacked administrative sessions.
    Rule Low Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host must disable Simple Network Management Protocol (SNMP) v1 and v2c.

    If SNMP is not being used, it must remain disabled. If it is being used, the proper trap destination must be configured. If SNMP is not properly configured, monitoring information can be sent to a ...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host must disable Inter-Virtual Machine (VM) Transparent Page Sharing.

    Published academic papers have demonstrated that by forcing a flush and reload of cache memory, it is possible to measure memory timings to try to determine an Advanced Encryption Standard (AES) en...
    Rule Low Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host must configure the firewall to block network traffic by default.

    In addition to service-specific firewall rules, ESXi has a default firewall rule policy to allow or deny incoming and outgoing traffic. Reduce the risk of attack by ensuring this is set to deny inc...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host must configure virtual switch security policies to reject forged transmits.

    If the virtual machine (VM) operating system changes the Media Access Control (MAC) address, the operating system can send frames with an impersonated source MAC address at any time. This allows an...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host must configure virtual switch security policies to reject promiscuous mode requests.

    When promiscuous mode is enabled for a virtual switch, all virtual machines (VMs) connected to the Portgroup have the potential to read all packets across that network (only the virtual machines co...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host must restrict use of the dvFilter network application programming interface (API).

    If the organization is not using products that use the dvFilter network API, the host should not be configured to send network information to a virtual machine (VM). If the API is enabled, an atta...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host must restrict the use of Virtual Guest Tagging (VGT) on standard switches.

    When a port group is set to VLAN 4095, the vSwitch passes all network frames to the attached virtual machines (VMs) without modifying the VLAN tags. In vSphere, this is referred to as VGT. The VM m...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules