Skip to content
Log In

II - Mission Support Public

Rules and Groups employed by this XCCDF Profile

  • SRG-OS-000095-VMM-000480

    Group
    Show

  • The ESXi host must be configured to disable nonessential capabilities by disabling Secure Shell (SSH).

    The ESXi Shell is an interactive command line interface (CLI) available at the ESXi server console. The ESXi shell provides temporary access to commands essential for server maintenance. Intended p...
    Rule Medium Severity
    Show

  • SRG-OS-000095-VMM-000480

    Group
    Show

  • The ESXi host must be configured to disable nonessential capabilities by disabling the ESXi shell.

    The ESXi Shell is an interactive command line environment available locally from the Direct Console User Interface (DCUI) or remotely via SSH. Activities performed from the ESXi Shell bypass vCente...
    Rule Medium Severity
    Show

  • SRG-OS-000163-VMM-000700

    Group
    Show

  • The ESXi host must automatically stop shell services after 10 minutes.

    When the ESXi Shell or Secure Shell (SSH) services are enabled on a host, they will run indefinitely. To avoid having these services left running, set the "ESXiShellTimeOut". The "ESXiShellTimeOut"...
    Rule Medium Severity
    Show

  • SRG-OS-000163-VMM-000700

    Group
    Show

  • The ESXi host must set a timeout to automatically end idle DCUI sessions after 10 minutes.

    When the Direct Console User Interface (DCUI) is enabled and logged in, it should be automatically logged out if left logged on to avoid access by unauthorized persons. The "DcuiTimeOut" setting de...
    Rule Medium Severity
    Show

  • SRG-OS-000423-VMM-001700

    Group
    Show

  • The ESXi host must protect the confidentiality and integrity of transmitted information by isolating ESXi management traffic.

    The vSphere management network provides access to the vSphere management interface on each component. Services running on the management interface provide an opportunity for an attacker to gain pri...
    Rule Medium Severity
    Show

  • SRG-OS-000423-VMM-001700

    Group
    Show

  • The ESXi host must protect the confidentiality and integrity of transmitted information by isolating IP-based storage traffic.

    Virtual machines (VMs) might share virtual switches and VLANs with the IP-based storage configurations. IP-based storage includes vSAN, iSCSI, and NFS. This configuration might expose IP-based stor...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host lockdown mode exception users list must be verified.

    While a host is in lockdown mode (strict or normal), only users on the "Exception Users" list are allowed access. These users do not lose their permissions when the host enters lockdown mode. The...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host Secure Shell (SSH) daemon must not allow host-based authentication.

    SSH trust relationships mean a compromise on one host can allow an attacker to move trivially to other hosts. SSH's cryptographic host-based authentication is more secure than ".rhosts" authenticat...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host Secure Shell (SSH) daemon must not permit user environment settings.

    SSH environment options potentially allow users to bypass access restriction in some configurations. Users must not be able to present environment options to the SSH daemon.
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host Secure Shell (SSH) daemon must be configured to not allow gateway ports.

    SSH Transmission Control Protocol (TCP) connection forwarding provides a mechanism to establish TCP connections proxied by the SSH server. This function can provide convenience similar to a virtual...
    Rule Low Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host Secure Shell (SSH) daemon must not permit tunnels.

    OpenSSH has the ability to create network tunnels (layer 2 and layer 3) over an SSH connection. This function can provide similar convenience to a virtual private network (VPN) with the similar ris...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host Secure Shell (SSH) daemon must set a timeout count on idle sessions.

    Setting a timeout ensures that a user login will be terminated as soon as the "ClientAliveCountMax" is reached.
    Rule Low Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host Secure Shell (SSH) daemon must set a timeout interval on idle sessions.

    Automatically logging out idle users guards against compromises via hijacked administrative sessions.
    Rule Low Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host must disable Simple Network Management Protocol (SNMP) v1 and v2c.

    If SNMP is not being used, it must remain disabled. If it is being used, the proper trap destination must be configured. If SNMP is not properly configured, monitoring information can be sent to a ...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host must disable Inter-Virtual Machine (VM) Transparent Page Sharing.

    Published academic papers have demonstrated that by forcing a flush and reload of cache memory, it is possible to measure memory timings to try to determine an Advanced Encryption Standard (AES) en...
    Rule Low Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host must configure the firewall to block network traffic by default.

    In addition to service-specific firewall rules, ESXi has a default firewall rule policy to allow or deny incoming and outgoing traffic. Reduce the risk of attack by ensuring this is set to deny inc...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host must enable Bridge Protocol Data Units (BPDU) filter on the host to prevent being locked out of physical switch ports with Portfast and BPDU Guard enabled.

    BPDU Guard and Portfast are commonly enabled on the physical switch to which the ESXi host is directly connected to reduce the Spanning Tree Protocol (STP) convergence delay. If a BPDU packet is s...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host must configure virtual switch security policies to reject forged transmits.

    If the virtual machine (VM) operating system changes the Media Access Control (MAC) address, the operating system can send frames with an impersonated source MAC address at any time. This allows an...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host must configure virtual switch security policies to reject Media Access Control (MAC) address changes.

    If the virtual machine (VM) operating system changes the MAC address, it can send frames with an impersonated source MAC address at any time. This allows it to stage malicious attacks on the device...
    Rule High Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host must configure virtual switch security policies to reject promiscuous mode requests.

    When promiscuous mode is enabled for a virtual switch, all virtual machines (VMs) connected to the Portgroup have the potential to read all packets across that network (only the virtual machines co...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host must restrict use of the dvFilter network application programming interface (API).

    If the organization is not using products that use the dvFilter network API, the host should not be configured to send network information to a virtual machine (VM). If the API is enabled, an atta...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host must restrict the use of Virtual Guest Tagging (VGT) on standard switches.

    When a port group is set to VLAN 4095, the vSwitch passes all network frames to the attached virtual machines (VMs) without modifying the VLAN tags. In vSphere, this is referred to as VGT. The VM m...
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host must have all security patches and updates installed.

    Installing software updates is a fundamental mitigation against the exploitation of publicly known vulnerabilities.
    Rule High Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host must not suppress warnings that the local or remote shell sessions are enabled.

    Warnings that local or remote shell sessions are enabled alert administrators to activity they may not be aware of and need to investigate.
    Rule Medium Severity
    Show

  • SRG-OS-000480-VMM-002000

    Group
    Show

  • The ESXi host must not suppress warnings about unmitigated hyperthreading vulnerabilities.

    The L1 Terminal Fault (L1TF) CPU vulnerabilities published in 2018 have patches and mitigations available in vSphere. However, there are performance impacts to these mitigations that require carefu...
    Rule Medium Severity
    Show

Node 2

siemur/test-space

The content of the drawer really is up to you. It could have form fields, definition lists, text lists, labels, charts, progress bars, etc. Spacing recommendation is 24px margins. You can put tabs in here, and can also make the drawer scrollable.

Capacity
Modules