Skip to content
ATO Pathways
  Log In

VMware vSphere 8.0 ESXi Security Technical Implementation Guide

Rules, Groups, and Values defined within the XCCDF Benchmark

  • SRG-OS-000095-VMM-000480

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host must be configured to disable nonessential capabilities by disabling Secure Shell (SSH).

    &lt;VulnDiscussion&gt;The ESXi Shell is an interactive command line interface (CLI) available at the ESXi server console. The ESXi shell provides t...
    Rule Medium Severity
    Show

  • SRG-OS-000095-VMM-000480

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host must be configured to disable nonessential capabilities by disabling the ESXi shell.

    &lt;VulnDiscussion&gt;The ESXi Shell is an interactive command line environment available locally from the Direct Console User Interface (DCUI) or ...
    Rule Medium Severity
    Show

  • SRG-OS-000163-VMM-000700

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host must automatically stop shell services after 10 minutes.

    &lt;VulnDiscussion&gt;When the ESXi Shell or Secure Shell (SSH) services are enabled on a host, they will run indefinitely. To avoid having these s...
    Rule Medium Severity
    Show

  • SRG-OS-000163-VMM-000700

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host must set a timeout to automatically end idle DCUI sessions after 10 minutes.

    &lt;VulnDiscussion&gt;When the Direct Console User Interface (DCUI) is enabled and logged in, it should be automatically logged out if left logged ...
    Rule Medium Severity
    Show

  • SRG-OS-000423-VMM-001700

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host must protect the confidentiality and integrity of transmitted information by isolating ESXi management traffic.

    &lt;VulnDiscussion&gt;The vSphere management network provides access to the vSphere management interface on each component. Services running on the...
    Rule Medium Severity
    Show

  • SRG-OS-000423-VMM-001700

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host must protect the confidentiality and integrity of transmitted information by isolating IP-based storage traffic.

    &lt;VulnDiscussion&gt;Virtual machines (VMs) might share virtual switches and VLANs with the IP-based storage configurations. IP-based storage incl...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host lockdown mode exception users list must be verified.

    &lt;VulnDiscussion&gt;While a host is in lockdown mode (strict or normal), only users on the "Exception Users" list are allowed access. These users...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host Secure Shell (SSH) daemon must not allow host-based authentication.

    &lt;VulnDiscussion&gt;SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts. SSH's cryptogra...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host Secure Shell (SSH) daemon must not permit user environment settings.

    &lt;VulnDiscussion&gt;SSH environment options potentially allow users to bypass access restriction in some configurations. Users must not be able t...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host Secure Shell (SSH) daemon must be configured to not allow gateway ports.

    &lt;VulnDiscussion&gt;SSH Transmission Control Protocol (TCP) connection forwarding provides a mechanism to establish TCP connections proxied by th...
    Rule Low Severity
    Show

  • SRG-OS-000480-VMM-002000

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host Secure Shell (SSH) daemon must not permit tunnels.

    &lt;VulnDiscussion&gt;OpenSSH has the ability to create network tunnels (layer 2 and layer 3) over an SSH connection. This function can provide sim...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host Secure Shell (SSH) daemon must set a timeout count on idle sessions.

    &lt;VulnDiscussion&gt;Setting a timeout ensures that a user login will be terminated as soon as the "ClientAliveCountMax" is reached.&lt;/VulnDiscu...
    Rule Low Severity
    Show

  • SRG-OS-000480-VMM-002000

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host Secure Shell (SSH) daemon must set a timeout interval on idle sessions.

    &lt;VulnDiscussion&gt;Automatically logging out idle users guards against compromises via hijacked administrative sessions.&lt;/VulnDiscussion&gt;&...
    Rule Low Severity
    Show

  • SRG-OS-000480-VMM-002000

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host must disable Simple Network Management Protocol (SNMP) v1 and v2c.

    &lt;VulnDiscussion&gt;If SNMP is not being used, it must remain disabled. If it is being used, the proper trap destination must be configured. If S...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host must disable Inter-Virtual Machine (VM) Transparent Page Sharing.

    &lt;VulnDiscussion&gt;Published academic papers have demonstrated that by forcing a flush and reload of cache memory, it is possible to measure mem...
    Rule Low Severity
    Show

  • SRG-OS-000480-VMM-002000

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host must configure the firewall to block network traffic by default.

    &lt;VulnDiscussion&gt;In addition to service-specific firewall rules, ESXi has a default firewall rule policy to allow or deny incoming and outgoin...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host must enable Bridge Protocol Data Units (BPDU) filter on the host to prevent being locked out of physical switch ports with Portfast and BPDU Guard enabled.

    &lt;VulnDiscussion&gt;BPDU Guard and Portfast are commonly enabled on the physical switch to which the ESXi host is directly connected to reduce th...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host must configure virtual switch security policies to reject forged transmits.

    &lt;VulnDiscussion&gt;If the virtual machine (VM) operating system changes the Media Access Control (MAC) address, the operating system can send fr...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host must configure virtual switch security policies to reject Media Access Control (MAC) address changes.

    &lt;VulnDiscussion&gt;If the virtual machine (VM) operating system changes the MAC address, it can send frames with an impersonated source MAC addr...
    Rule High Severity
    Show

  • SRG-OS-000480-VMM-002000

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host must configure virtual switch security policies to reject promiscuous mode requests.

    &lt;VulnDiscussion&gt;When promiscuous mode is enabled for a virtual switch, all virtual machines (VMs) connected to the Portgroup have the potenti...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host must restrict use of the dvFilter network application programming interface (API).

    &lt;VulnDiscussion&gt;If the organization is not using products that use the dvFilter network API, the host should not be configured to send networ...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host must restrict the use of Virtual Guest Tagging (VGT) on standard switches.

    &lt;VulnDiscussion&gt;When a port group is set to VLAN 4095, the vSwitch passes all network frames to the attached virtual machines (VMs) without m...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host must have all security patches and updates installed.

    &lt;VulnDiscussion&gt;Installing software updates is a fundamental mitigation against the exploitation of publicly known vulnerabilities.&lt;/VulnD...
    Rule High Severity
    Show

  • SRG-OS-000480-VMM-002000

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host must not suppress warnings that the local or remote shell sessions are enabled.

    &lt;VulnDiscussion&gt;Warnings that local or remote shell sessions are enabled alert administrators to activity they may not be aware of and need t...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    <GroupDescription></GroupDescription>
    Group
    Show

  • The ESXi host must not suppress warnings about unmitigated hyperthreading vulnerabilities.

    &lt;VulnDiscussion&gt;The L1 Terminal Fault (L1TF) CPU vulnerabilities published in 2018 have patches and mitigations available in vSphere. However...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules