TMA-ESXI9-3.11
Host must enforce password complexity
Description
The enforcement of password complexity is managed through the Security.PasswordQualityControl parameter, allowing configuration of password length, character set requirements, and failed logon attempt restrictions. The recommended setting is "retry=3 min=disabled,15,15,15,15 max=64 similar=deny passphrase=3". The audit reads Security.PasswordQualityControl with esxcli and requires min=disabled,disabled,disabled,disabled,N with N of 15 or more. Runs in the ESXi Shell (busybox sh) as root.
How it is checked
Audit method: Shell command
out=$(esxcli system settings advanced list -o /Security/PasswordQualityControl 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | sed -n 's/^ *String Value: *//p' | head -n 1)
m=$(printf '%s\n' "$v" | tr ' ' '\n' | sed -n 's/^min=//p' | head -n 1)
[ -n "$m" ] || { echo "no min= in '$v'"; exit 1; }
printf '%s\n' "$m" | awk -F, '{ if (NF == 5 && $1 == "disabled" && $2 == "disabled" && $3 == "disabled" && $4 == "disabled" && $5 ~ /^[0-9]+$/ && $5 + 0 >= 15) print "compliant"; else print "min=" $0 }'- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
To set the password complexity requirements, perform the following PowerCLI command: Get-VMHOST | Get-AdvancedSetting -Name "Security.PasswordQualityControl" | Set- AdvancedSetting -Value "retry=3 min=disabled,disabled,disabled,disabled,15" The above requires all passwords to be 15 or more characters long and comprised of at least one character from four distinct character sets.
Properties
- Operating systems
- Any
- Tags
- vmwareesximanagement
- Reference
- CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.11 Host must enforce password complexity
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target vmware