TMA-VMWARE-3.11
Host must enforce password complexity
Beschreibung
The enforcement of password complexity is managed through the Security.PasswordQualityControl parameter, allowing configuration of password length, character set requirements, and failed logon attempt restrictions. The recommended setting is "retry=3 min=disabled,15,15,15,15 max=64 similar=deny passphrase=3". The audit reads Security.PasswordQualityControl with esxcli and requires min=disabled,disabled,disabled,disabled,N with N of 15 or more. Runs in the ESXi Shell (busybox sh) as root.
So wird geprüft
Prüfmethode: Shell-Befehl
out=$(esxcli system settings advanced list -o /Security/PasswordQualityControl 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | sed -n 's/^ *String Value: *//p' | head -n 1)
m=$(printf '%s\n' "$v" | tr ' ' '\n' | sed -n 's/^min=//p' | head -n 1)
[ -n "$m" ] || { echo "no min= in '$v'"; exit 1; }
printf '%s\n' "$m" | awk -F, '{ if (NF == 5 && $1 == "disabled" && $2 == "disabled" && $3 == "disabled" && $4 == "disabled" && $5 ~ /^[0-9]+$/ && $5 + 0 >= 15) print "compliant"; else print "min=" $0 }'- Erwartete Ausgabe
compliant
So wird behoben
Behebungsmethode: Anleitung oder Infrastruktur-Patch
To set the password complexity requirements, perform the following PowerCLI command: Get-VMHOST | Get-AdvancedSetting -Name "Security.PasswordQualityControl" | Set-AdvancedSetting -Value "retry=3 min=disabled,disabled,disabled,disabled,15" The above requires all passwords to be 15 or more characters long and comprised of at least one character from four distinct character sets.
Eigenschaften
- Betriebssysteme
- Beliebig
- Tags
- vmwareesximanagement
- Referenz
- CIS VMware ESXi 8.0 Benchmark v1.4.0 - 3.11 Host must enforce password complexity
Diesen Host prüfen
Führen Sie dies auf einem Rechner aus, den Sie prüfen dürfen. Der Scan ist schreibgeschützt.
tmaegis scan --target vmware