Virtual machines must require encryption for vMotion

MediumLevel 1Automatedvmware

Description

Requiring encryption for vMotion ensures the secure transfer of data among virtual machines. While the default 'opportunistic' encryption setting generally provides encryption due to prevalent AES-NI support, enforcing 'required' encryption eradicates the possibility of unencrypted transfers. Expected: migrate.encryptionMode = "required". The audit parses every .vmx file under /vmfs/volumes/ on the host and lists the VMs that do not comply; it passes when none are found (or no VMs exist). Runs in the ESXi Shell (busybox sh) as root.

How it is checked

Audit method: Shell command

shell

command -v find >/dev/null 2>&1 || exit 1
out=$(find /vmfs/volumes/ -maxdepth 3 -type f -name '*.vmx' 2>/dev/null | while IFS= read -r f; do
  awk -v KEYRE='^migrate[.]encryptionmode$' -v MODE='eq' -v VAL='required' 'BEGIN { re = tolower(KEYRE) }
{ line = $0; sub(/^[ \t]+/, "", line); i = index(line, "="); if (i == 0) next
  k = tolower(substr(line, 1, i - 1)); sub(/[ \t]+$/, "", k)
  v = substr(line, i + 1); sub(/^[ \t]*"?/, "", v); sub(/"?[ \t\r]*$/, "", v); v = tolower(v)
  if (k ~ re) { seen = 1; if (MODE == "not" && v == tolower(VAL)) bad = bad " " k "=" v
                else if (MODE != "not" && MODE != "ge" && v != tolower(VAL)) bad = bad " " k "=" v
                else if (MODE == "ge" && (v + 0) < (VAL + 0)) bad = bad " " k "=" v } }
END { if ((MODE == "eq" || MODE == "ge") && !seen) bad = " " KEYRE " not set"
      if (bad != "") print FILENAME ":" bad }' "$f"
done)
[ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 25

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

The following PowerCLI command may be used: $VMview = Get-VM -Name $VM | Get-View $ConfigSpec = New-Object VMware.Vim.VirtualMachineConfigSpec $ConfigSpec.MigrateEncryption = New-Object VMware.Vim.VirtualMachineConfigSpecEncryptedVMotionModes $ConfigSpec.MigrateEncryption = "required" $VMview.ReconfigVM_Task($ConfigSpec)

Properties

Operating systems: Any
Tags: vmwareesxivirtual-machine
Reference: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 7.2 Virtual machines must require encryption for vMotion

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target vmware