VMware vSphere 8.0 ESXi Security Technical Implementation Guide
Rules, Groups, and Values defined within the XCCDF Benchmark
-
The ESXi host must protect the confidentiality and integrity of transmitted information by isolating ESXi management traffic.
The vSphere management network provides access to the vSphere management interface on each component. Services running on the management interface provide an opportunity for an attacker to gain pri...Rule Medium Severity -
SRG-OS-000423-VMM-001700
Group -
SRG-OS-000480-VMM-002000
Group -
The ESXi host lockdown mode exception users list must be verified.
While a host is in lockdown mode (strict or normal), only users on the "Exception Users" list are allowed access. These users do not lose their permissions when the host enters lockdown mode. The...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host Secure Shell (SSH) daemon must not allow host-based authentication.
SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts. SSH's cryptographic host-based authentication is more secure than ".rhosts" authenticat...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host Secure Shell (SSH) daemon must not permit user environment settings.
SSH environment options potentially allow users to bypass access restriction in some configurations. Users must not be able to present environment options to the SSH daemon.Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host Secure Shell (SSH) daemon must be configured to not allow gateway ports.
SSH Transmission Control Protocol (TCP) connection forwarding provides a mechanism to establish TCP connections proxied by the SSH server. This function can provide convenience similar to a virtual...Rule Low Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host Secure Shell (SSH) daemon must not permit tunnels.
OpenSSH has the ability to create network tunnels (layer 2 and layer 3) over an SSH connection. This function can provide similar convenience to a virtual private network (VPN) with the similar ris...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host Secure Shell (SSH) daemon must set a timeout count on idle sessions.
Setting a timeout ensures that a user login will be terminated as soon as the "ClientAliveCountMax" is reached.Rule Low Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host Secure Shell (SSH) daemon must set a timeout interval on idle sessions.
Automatically logging out idle users guards against compromises via hijacked administrative sessions.Rule Low Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must disable Simple Network Management Protocol (SNMP) v1 and v2c.
If SNMP is not being used, it must remain disabled. If it is being used, the proper trap destination must be configured. If SNMP is not properly configured, monitoring information can be sent to a ...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must configure the firewall to block network traffic by default.
In addition to service-specific firewall rules, ESXi has a default firewall rule policy to allow or deny incoming and outgoing traffic. Reduce the risk of attack by ensuring this is set to deny inc...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must configure virtual switch security policies to reject forged transmits.
If the virtual machine (VM) operating system changes the Media Access Control (MAC) address, the operating system can send frames with an impersonated source MAC address at any time. This allows an...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must configure virtual switch security policies to reject Media Access Control (MAC) address changes.
If the virtual machine (VM) operating system changes the MAC address, it can send frames with an impersonated source MAC address at any time. This allows it to stage malicious attacks on the device...Rule High Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must configure virtual switch security policies to reject promiscuous mode requests.
When promiscuous mode is enabled for a virtual switch, all virtual machines (VMs) connected to the Portgroup have the potential to read all packets across that network (only the virtual machines co...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must restrict use of the dvFilter network application programming interface (API).
If the organization is not using products that use the dvFilter network API, the host should not be configured to send network information to a virtual machine (VM). If the API is enabled, an atta...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must have all security patches and updates installed.
Installing software updates is a fundamental mitigation against the exploitation of publicly known vulnerabilities.Rule High Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must not suppress warnings that the local or remote shell sessions are enabled.
Warnings that local or remote shell sessions are enabled alert administrators to activity they may not be aware of and need to investigate.Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must not suppress warnings about unmitigated hyperthreading vulnerabilities.
The L1 Terminal Fault (L1TF) CPU vulnerabilities published in 2018 have patches and mitigations available in vSphere. However, there are performance impacts to these mitigations that require carefu...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must verify certificates for SSL syslog endpoints.
When sending syslog data to a remote host, ESXi can be configured to use any combination of TCP, UDP, and SSL transports. When using SSL, the server certificate must be validated to ensure that the...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must enable volatile key destruction.
By default, pages allocated for virtual machines (VMs), userspace applications, and kernel threads are zeroed out at allocation time. ESXi will always ensure that no nonzero pages are exposed to VM...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must be configured with an appropriate maximum password age.
The older an ESXi local account password is, the larger the opportunity window is for attackers to guess, crack or reuse a previously cracked password. Rotating passwords on a regular basis is a fu...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
SRG-OS-000480-VMM-002000
Group -
The ESXi host must use DOD-approved certificates.
The default self-signed host certificate issued by the VMware Certificate Authority (VMCA) must be replaced with a DOD-approved certificate when the host will be accessed directly, such as during a...Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group -
The ESXi host Secure Shell (SSH) daemon must disable port forwarding.
While enabling Transmission Control Protocol (TCP) tunnels is a valuable function of sshd, this feature is not appropriate for use on the ESXi hypervisor.Rule Medium Severity -
SRG-OS-000480-VMM-002000
Group
Node 2
The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.