Host SSH daemon, if enabled, must display the system login banner before granting access

MittelStufe 1Automatisiertvmware

Beschreibung

Implementing a system login banner before granting SSH access ensures that crucial information or notices are conveyed to users attempting to login. The banner text is set through the host's Config.Etc.Issue advanced parameter. The audit reads /etc/ssh/sshd_config and requires a Banner directive pointing to a non-empty file. Runs in the ESXi Shell (busybox sh) as root.

So wird geprüft

Prüfmethode: Shell-Befehl

shell

f=/etc/ssh/sshd_config; [ -r "$f" ] || exit 1
b=$(awk 'tolower($1)=="banner" {print $2; exit}' "$f")
case "$b" in ''|none) echo 'no SSH Banner configured'; exit 1 ;; esac
[ -s "$b" ] && echo compliant || echo "banner file $b is missing or empty"

Erwartete Ausgabe: compliant

So wird behoben

Behebungsmethode: Anleitung oder Infrastruktur-Patch

To remediate this recommendation, configure the approved SSH banner file and Banner directive. Restart SSH only if enabled/authorized and confirm the banner appears before authentication.

Eigenschaften

Betriebssysteme: Beliebig
Tags: vmwareesxiservices
Referenz: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 6.5.7 Host SSH daemon, if enabled, must display the system login banner before granting access

Diesen Host prüfen

Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.

shell

tmaegis scan --target vmware