Host must display a login banner for SSH connections

MittelStufe 1Automatisiertvmware

Beschreibung

ESXi facilitates the display of a login message, primarily aimed to deter unauthorized access and inform legitimate users regarding system usage obligations, particularly during SSH connections. The text for this display is defined by a specific parameter, which is advisable to be configured, especially when SSH is active, albeit it's recommended to keep SSH in a stopped state ... The audit reads /etc/ssh/sshd_config and requires a Banner directive pointing to a non-empty file. Runs in the ESXi Shell (busybox sh) as root.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

f=/etc/ssh/sshd_config; [ -r "$f" ] || exit 1
b=$(awk 'tolower($1)=="banner" {print $2; exit}' "$f")
case "$b" in ''|none) echo 'no SSH Banner configured'; exit 1 ;; esac
[ -s "$b" ] && echo compliant || echo "banner file $b is missing or empty"

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

1. Configure Banner /etc/issue in the SSH configuration and place the approved warning text in the referenced file. 2. Restart SSH only if it is authorized to be running; otherwise leave SSH disabled.

Eigenschaften

Betriebssysteme: Beliebig
Tags: vmwareesximanagement
Referenz: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.25 Host must display a login banner for SSH connections

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target vmware