VMware ESXi
TMA-ESXI9-3.7
Host must automatically terminate idle DCUI sessions
Beschreibung
By configuring a session timeout, unattended console sessions are automatically terminated, thereby reducing the potential security risks associated with lingering active sessions. The parameter governing this behavior is UserVars.DcuiTimeOut, with a recommended setting of 600 (10 minutes). The audit reads UserVars.DcuiTimeOut with esxcli and requires 600 seconds or less (0 disables the timeout and fails). Runs in the ESXi Shell (busybox sh) as root.
So wird geprüft
Prüfmethode: Shell-Befehl
out=$(esxcli system settings advanced list -o /UserVars/DcuiTimeOut 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/UserVars/DcuiTimeOut: no integer value'; exit 1 ;; esac
if [ "$v" -gt 0 ] && [ "$v" -le 600 ]; then echo compliant; else echo "/UserVars/DcuiTimeOut = $v (expected 1-600)"; fi- Erwartete Ausgabe
compliant
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
To correct the DCUI timeout setting, perform the following steps: 1. From the vSphere Web Client, select the host. 2. Click Configure, then under System select Advanced System Settings. 3. Select Edit then enter UserVars.DcuiTimeOut in the filter. 4. Click in the box for the current value, then set the value to 600 seconds or less. Alternately, use the following PowerCLI command: Get-VMHost | Get-AdvancedSetting -Name UserVars.DcuiTimeOut | Set-AdvancedSetting -Value 600
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- vmwareesximanagement
- Referenz
- CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.7 Host must automatically terminate idle DCUI sessions
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
tmaegis scan --target vmware