STIGQter: STIG Summary: VMware vSphere 6.7 ESXi Security Technical Implementation Guide Version: 1 Release: 1 Benchmark Date: 09 Mar 2021:

The ESXi host SSH daemon must ignore .rhosts files.

DISA Rule

SV-239268r674733_rule

Vulnerability Number

V-239268

Group Title

SRG-OS-000107-VMM-000530

Rule Version

ESXI-67-000012

Severity

CAT II

CCI(s)

• CCI-000767 - The information system implements multifactor authentication for local access to privileged accounts.

Weight

10

Fix Recommendation

From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":

Add or correct the following line in "/etc/ssh/sshd_config":

IgnoreRhosts yes

Check Contents

From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:

# grep -i "^IgnoreRhosts" /etc/ssh/sshd_config

If there is no output or the output is not exactly "IgnoreRhosts yes", this is a finding.

Vulnerability Number

V-239268

Documentable

False

Rule Version

ESXI-67-000012

Severity Override Guidance

From an SSH session connected to the ESXi host, or from the ESXi shell, run the following command:

# grep -i "^IgnoreRhosts" /etc/ssh/sshd_config

If there is no output or the output is not exactly "IgnoreRhosts yes", this is a finding.

Check Content Reference

M

Target Key

5326

Comments