TMAegisBeta
Weitere Regeln für vmware

VMware ESXi

TMA-ESXI9-3.8

Host must automatically terminate idle shells

MittelStufe 1Automatisiertvmware

Beschreibung

The host should be configured to automatically terminate idle shell sessions to prevent potential unauthorized access due to forgotten logouts. Setting a timeout for idle SSH connections ensures that any unattended sessions are closed, thereby reducing the security risk. The parameter governing this behavior is UserVars. The audit reads UserVars.ESXiShellInteractiveTimeOut with esxcli and requires 300 seconds or less (0 disables it and fails). Runs in the ESXi Shell (busybox sh) as root.

So wird geprüft

Prüfmethode: Shell-Befehl

shell
out=$(esxcli system settings advanced list -o /UserVars/ESXiShellInteractiveTimeOut 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/UserVars/ESXiShellInteractiveTimeOut: no integer value'; exit 1 ;; esac
if [ "$v" -gt 0 ] && [ "$v" -le 300 ]; then echo compliant; else echo "/UserVars/ESXiShellInteractiveTimeOut = $v (expected 1-300)"; fi
Erwartete Ausgabe
compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

To set the timeout to the desired value, perform the following from the vSphere web client: 1. From the vSphere Web Client, select the host. 2. Click Configure then expand System. 3. Select Advanced System Settings then click Edit. 4. Enter ESXiShellInteractiveTimeOut in the filter. 5. Set the value for this parameter is set to the appropriate value (300 seconds or less). 6. Click OK. Note: A value of 0 disables the ESXi ShellInteractiveTimeOut. Alternately, use the following PowerCLI command: # Set Remove UserVars.ESXiShellInteractiveTimeOut to 300 on all hosts Get-VMHost | Get-AdvancedSetting -Name 'UserVars.ESXiShellInteractiveTimeOut' | Set-AdvancedSetting -Value "300"

Eigenschaften

Betriebssysteme
Beliebig
Tags
vmwareesximanagement
Referenz
CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.8 Host must automatically terminate idle shells

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell
tmaegis scan --target vmware