Host must deny shell access for the dcui account

Cómo se verifica

Método de auditoría: Comando de shell

out=$(esxcli system account list 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="dcui" {print tolower($NF); exit}')
case "$v" in false) echo compliant ;; '') echo 'dcui not listed (or no Shell Access column on this build)'; exit 1 ;; *) echo 'dcui shell access: '"$v" ;; esac

Salida esperada

compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Configure the dcui service account to have no shell access using the supported ESXi account-management mechanism for the installed build, and verify that the account cannot establish an interactive shell. Note: It is advised not to manually edit /etc/passwd unless directed by Broadcom support.

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

tmaegis scan --target vmware