Host must deactivate SLP

MediumLevel 1Automatedvmware

Description

The Service Location Protocol (SLP) is used for the discovery and selection of network services in local area networks, which simplifies configuration by allowing computers to find necessary services automatically. The practice of deactivating SLP when not in use aligns with the principle of minimizing the attack surface by shutting down non-essential services. The audit runs /etc/init.d/slpd status and requires "not running". Runs in the ESXi Shell (busybox sh) as root.

How it is checked

Audit method: Shell command

shell

st=$(/etc/init.d/slpd status 2>&1)
case "$st" in *'not running'*) echo compliant ;; *running*) echo 'slpd is running' ;; *) echo "slpd status: $st"; exit 1 ;; esac

Expected output: compliant

How it is fixed

Fix method: Guidance or infrastructure patch

1. Stop SLP if running: /etc/init.d/slpd stop Note: Confirm no operational dependency requires SLP before disabling it.

Properties

Operating systems: Any
Tags: vmwareesximanagement
Reference: CIS VMware ESXi 8.0 Benchmark v1.4.0 - 3.4 Host must deactivate SLP

Check this host

Run this on a machine you are allowed to audit. The scan is read-only.

shell

tmaegis scan --target vmware