STIGQter STIGQter: STIG Summary: VMware vSphere 6.7 ESXi Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 09 Mar 2021:

The ESXi host must verify the DCUI.Access list.

DISA Rule

SV-239259r674706_rule

Vulnerability Number

V-239259

Group Title

SRG-OS-000480-VMM-002000

Rule Version

ESXI-67-000002

Severity

CAT III

CCI(s)

Weight

10

Fix Recommendation

From the vSphere Client, select the ESXi host and go to Configure >> System >> Advanced System Settings.

Click "Edit", select the "DCUI.Access" value, and configure it to root.

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name DCUI.Access | Set-AdvancedSetting -Value "root"

Check Contents

For environments that do not use vCenter server to manage ESXi, this is Not Applicable.

From the vSphere Client, select the ESXi host and go to Configure >> System >> Advanced System Settings.

Select the "DCUI.Access" value and verify that only the root user is listed.

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name DCUI.Access and verify it is set to root.

If the DCUI.Access is not restricted to root, this is a finding.

Note: This list is only for local user accounts and should only contain the root user.

Vulnerability Number

V-239259

Documentable

False

Rule Version

ESXI-67-000002

Severity Override Guidance

For environments that do not use vCenter server to manage ESXi, this is Not Applicable.

From the vSphere Client, select the ESXi host and go to Configure >> System >> Advanced System Settings.

Select the "DCUI.Access" value and verify that only the root user is listed.

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name DCUI.Access and verify it is set to root.

If the DCUI.Access is not restricted to root, this is a finding.

Note: This list is only for local user accounts and should only contain the root user.

Check Content Reference

M

Target Key

5326

Comments