STIGQter: STIG Summary: VMware vSphere 6.5 ESXi Security Technical Implementation Guide Version: 2 Release: 1 Benchmark Date: 22 Jan 2021:

The ESXi host must enable kernel core dumps.

DISA Rule

SV-207645r379318_rule

Vulnerability Number

V-207645

Group Title

SRG-OS-000269-VMM-000950

Rule Version

ESXI-65-000044

Severity

CAT III

CCI(s)

• CCI-001665 - The information system preserves organization-defined system state information in the event of a system failure.

Weight

10

Fix Recommendation

From the vSphere Web Client select the ESXi Host and right click. Select the "Add Diagnostic Partition" option configure a core dump diagnostic partition.

or

From a PowerCLI command prompt while connected to the ESXi host run at least one of the following sets of commands:

To configure a core dump partition:

$esxcli = Get-EsxCli
#View available partitions to configure
$esxcli.system.coredump.partition.list()
$esxcli.system.coredump.partition.set($null,"PartitionName",$null,$null)

To configure a core dump collector:

$esxcli = Get-EsxCli
$esxcli.system.coredump.network.set($null,"vmkernel port to use",$null,"CollectorIP","CollectorPort")
$esxcli.system.coredump.network.set($true)

Check Contents

From the vSphere Web Client select the ESXi Host and right click. If the "Add Diagnostic Partition" option is greyed out then core dumps are configured.

or

From a PowerCLI command prompt while connected to the ESXi host run the following commands:

$esxcli = Get-EsxCli
$esxcli.system.coredump.partition.get()
$esxcli.system.coredump.network.get()

The first command prepares for the other two. The second command shows whether there is an active core dump partition configured. The third command shows whether a network core dump collector is configured and enabled, via the "HostVNic", "NetworkServerIP", "NetworkServerPort", and "Enabled" variables.

If there is no active core dump partition or the network core dump collector is not configured and enabled, this is a finding.

Vulnerability Number

V-207645

Documentable

False

Rule Version

ESXI-65-000044

Severity Override Guidance

From the vSphere Web Client select the ESXi Host and right click. If the "Add Diagnostic Partition" option is greyed out then core dumps are configured.

or

From a PowerCLI command prompt while connected to the ESXi host run the following commands:

$esxcli = Get-EsxCli
$esxcli.system.coredump.partition.get()
$esxcli.system.coredump.network.get()

The first command prepares for the other two. The second command shows whether there is an active core dump partition configured. The third command shows whether a network core dump collector is configured and enabled, via the "HostVNic", "NetworkServerIP", "NetworkServerPort", and "Enabled" variables.

If there is no active core dump partition or the network core dump collector is not configured and enabled, this is a finding.

Check Content Reference

M

Target Key

2925

Comments