STIGQter: STIG Summary: VMware vSphere 6.7 ESXi Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 09 Mar 2021:

The ESXi host must verify the exception users list for Lockdown Mode.

DISA Rule

SV-239260r674709_rule

Vulnerability Number

V-239260

Group Title

SRG-OS-000480-VMM-002000

Rule Version

ESXI-67-000003

Severity

CAT III

CCI(s)

• CCI-000366 - The organization implements the security configuration settings.

Weight

10

Fix Recommendation

From the vSphere Client, select the ESXi host and go to Configure >> System >> Security Profile.

Under "Lockdown Mode", click "Edit" and remove unnecessary users from the exceptions list.

Check Contents

For environments that do not use vCenter server to manage ESXi, this is Not Applicable.

From the vSphere Client, select the ESXi host and go to Configure >> System >> Security Profile.

Under Lockdown Mode, review the Exception Users list.

or

From a PowerCLI command prompt while connected to the ESXi host, run the following script:

$vmhost = Get-VMHost | Get-View
$lockdown = Get-View $vmhost.ConfigManager.HostAccessManager
$lockdown.QueryLockdownExceptions()

If the Exception Users list contains accounts that do not require special permissions, this is a finding.

Note: This list is not intended for system administrator accounts but for special circumstances such as a service account.

Vulnerability Number

V-239260

Documentable

False

Rule Version

ESXI-67-000003

Severity Override Guidance

For environments that do not use vCenter server to manage ESXi, this is Not Applicable.

From the vSphere Client, select the ESXi host and go to Configure >> System >> Security Profile.

Under Lockdown Mode, review the Exception Users list.

or

From a PowerCLI command prompt while connected to the ESXi host, run the following script:

$vmhost = Get-VMHost | Get-View
$lockdown = Get-View $vmhost.ConfigManager.HostAccessManager
$lockdown.QueryLockdownExceptions()

If the Exception Users list contains accounts that do not require special permissions, this is a finding.

Note: This list is not intended for system administrator accounts but for special circumstances such as a service account.

Check Content Reference

M

Target Key

5326

Comments