STIGQter: STIG Summary: VMware vSphere 6.5 ESXi Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

The ESXi host must verify the exception users list for lockdown mode.

DISA Rule

SV-207604r388482_rule

Vulnerability Number

V-207604

Group Title

SRG-OS-000480-VMM-002000

Rule Version

ESXI-65-000003

Severity

CAT III

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

From the vSphere Web Client select the ESXi Host and go to Configure >> System >> Security Profile. Under lockdown mode click Edit and remove unnecessary users to the exceptions list.

Check Contents

From the vSphere Web Client select the ESXi Host and go to Configure >> System >> Security Profile. Under lockdown mode review the exception users list.

or

From a PowerCLI command prompt while connected to the ESXi host run the following script:

$vmhost = Get-VMHost | Get-View
$lockdown = Get-View $vmhost.ConfigManager.HostAccessManager
$lockdown.QueryLockdownExceptions()

If the Exception users list contains accounts that do not require special permissions, this is a finding.

Note - This list is not intended for system administrator accounts but for special circumstances such as a service account.

For environments that do not use vCenter server to manage ESXi, this is not applicable.

Vulnerability Number

V-207604

Documentable

False

Rule Version

ESXI-65-000003

Severity Override Guidance

From the vSphere Web Client select the ESXi Host and go to Configure >> System >> Security Profile. Under lockdown mode review the exception users list.

or

From a PowerCLI command prompt while connected to the ESXi host run the following script:

$vmhost = Get-VMHost | Get-View
$lockdown = Get-View $vmhost.ConfigManager.HostAccessManager
$lockdown.QueryLockdownExceptions()

If the Exception users list contains accounts that do not require special permissions, this is a finding.

Note - This list is not intended for system administrator accounts but for special circumstances such as a service account.

For environments that do not use vCenter server to manage ESXi, this is not applicable.

Check Content Reference

M

Target Key

2925

Comments