VMware ESXi
TMA-ESXI9-3.17
Host must automatically terminate idle host client sessions
Description
Configuring the host to automatically terminate idle host client sessions helps mitigate security risks associated with unattended sessions, which could potentially be exploited. The recommended setting for this control is a timeout value of 900. The parameter governing this behavior is UserVars.HostClientSessionTimeout. The audit reads UserVars.HostClientSessionTimeout with esxcli and requires 900 seconds or less (0 = unlimited fails). Runs in the ESXi Shell (busybox sh) as root.
How it is checked
Audit method: Shell command
out=$(esxcli system settings advanced list -o /UserVars/HostClientSessionTimeout 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/UserVars/HostClientSessionTimeout: no integer value'; exit 1 ;; esac
if [ "$v" -gt 0 ] && [ "$v" -le 900 ]; then echo compliant; else echo "/UserVars/HostClientSessionTimeout = $v (expected 1-900)"; fi- Expected output
compliant
How it is fixed
Fix method: Guidance or infrastructure patch
1. Set the approved idle timeout with Get-VMHost | Get-AdvancedSetting -Name UserVars.HostClientSessionTimeout | Set-AdvancedSetting -Value <seconds> -Confirm:$false 2. Reconnect to the Host Client and confirm inactive sessions expire as expected.
Properties
- Operating systems
- Any
- Tags
- vmwareesximanagement
- Reference
- CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.17 Host must automatically terminate idle host client sessions
Check this host
Run this on a machine you are allowed to audit. The scan is read-only.
tmaegis scan --target vmware