VMware ESXi
TMA-ESXI9-3.22
Host must deny shell access for the dcui account
Beschreibung
The dcui account, utilized for process isolation for the Direct Console User Interface (DCUI), possesses shell access which, when deactivated, minimizes the attack surface. This action is a proactive measure to enhance system security. The audit runs esxcli system account list and requires Shell Access false for dcui. Runs in the ESXi Shell (busybox sh) as root.
So wird geprüft
Prüfmethode: Shell-Befehl
out=$(esxcli system account list 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="dcui" {print tolower($NF); exit}')
case "$v" in false) echo compliant ;; '') echo 'dcui not listed (or no Shell Access column on this build)'; exit 1 ;; *) echo 'dcui shell access: '"$v" ;; esac- Erwartete Ausgabe
compliant
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
Configure the dcui service account to have no shell access using the supported ESXi account-management mechanism for the installed build, and verify that the account cannot establish an interactive shell. Note: It is advised not to manually edit /etc/passwd unless directed by Broadcom support.
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- vmwareesximanagement
- Referenz
- CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.22 Host must deny shell access for the dcui account
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
tmaegis scan --target vmware