Host must automatically terminate idle host client sessions

MediaNivel 1Automatizadavmware

Descripción

Configuring the host to automatically terminate idle host client sessions helps mitigate security risks associated with unattended sessions, which could potentially be exploited. The recommended setting for this control is a timeout value of 900. The parameter governing this behavior is UserVars.HostClientSessionTimeout. The audit reads UserVars.HostClientSessionTimeout with esxcli and requires 900 seconds or less (0 = unlimited fails). Runs in the ESXi Shell (busybox sh) as root.

Cómo se verifica

Método de auditoría: Comando de shell

shell

out=$(esxcli system settings advanced list -o /UserVars/HostClientSessionTimeout 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/UserVars/HostClientSessionTimeout: no integer value'; exit 1 ;; esac
if [ "$v" -gt 0 ] && [ "$v" -le 900 ]; then echo compliant; else echo "/UserVars/HostClientSessionTimeout = $v (expected 1-900)"; fi

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

1. Set the approved idle timeout with Get-VMHost | Get-AdvancedSetting -Name UserVars.HostClientSessionTimeout | Set-AdvancedSetting -Value <seconds> -Confirm:$false 2. Reconnect to the Host Client and confirm inactive sessions expire as expected.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: vmwareesximanagement
Referencia: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.17 Host must automatically terminate idle host client sessions

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target vmware