Host must use strict x509 verification for TLS-enabled remote logging endpoints

MittelStufe 1Automatisiertvmware

Beschreibung

When employing remote logging with TLS-enabled endpoints, it is essential to ensure the utmost integrity and authenticity of the certificates in use. The "x509-strict" option provides a higher level of security by performing additional validity checks on CA root certificates during the verification process. The audit reads Syslog.global.certificate.strictX509Compliance with esxcli and requires true (1). Runs in the ESXi Shell (busybox sh) as root.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

out=$(esxcli system settings advanced list -o /Syslog/global/certificate/strictX509Compliance 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/Syslog/global/certificate/strictX509Compliance: no integer value'; exit 1 ;; esac
if [ "$v" -eq 1 ]; then echo compliant; else echo "/Syslog/global/certificate/strictX509Compliance = $v (expected true/1)"; fi

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

Utilize PowerCLI to remediate </> Powershell Get-VMHost | Get-AdvancedSetting -Name "Syslog.global.certificate.strictX509Compliance" | Set-AdvancedSetting -Value $true -Confirm:$false Verify with Get-VMHost | Get-AdvancedSetting -Name "Syslog.global.certificate.strictX509Compliance" Expected Calue is: Value = True

Eigenschaften

Betriebssysteme: Beliebig
Tags: vmwareesxilogging
Referenz: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 4.11 Host must use strict x509 verification for TLS-enabled remote logging endpoints

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target vmware