STIGQter: STIG Summary: VMware vSphere 6.5 ESXi Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

The password hashes stored on the ESXi host must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm.

DISA Rule

SV-207634r388482_rule

Vulnerability Number

V-207634

Group Title

SRG-OS-000480-VMM-002000

Rule Version

ESXI-65-000033

Severity

CAT II

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in “/etc/pam.d/passwd”:

password sufficient /lib/security/$ISA/pam_unix.so use_authtok nullok shadow sha512 remember=5

Check Contents

From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:

# grep -i "^password" /etc/pam.d/passwd | grep sufficient

If sha512 is not listed, this is a finding.

Vulnerability Number

V-207634

Documentable

False

Rule Version

ESXI-65-000033

Severity Override Guidance

From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:

# grep -i "^password" /etc/pam.d/passwd | grep sufficient

If sha512 is not listed, this is a finding.

Check Content Reference

M

Target Key

2925

Comments