Host must deactivate CIM

MediaNivel 1Automatizadavmware

Descripción

Deactivating the Common Information Model (CIM) service, when not in use, aligns with the principle of minimizing the attack surface by disabling non-essential services. This action helps in reducing the potential vectors of attack, thus bolstering the host's security posture. The audit runs esxcli system wbem get and requires "Enabled: false". Document an exception when CIM is required. Runs in the ESXi Shell (busybox sh) as root.

Cómo se verifica

Método de auditoría: Comando de shell

shell

out=$(esxcli system wbem get 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk -F': *' 'tolower($1) ~ /^ *enabled$/ {print $2; exit}' | tr 'A-Z' 'a-z' | sed 's/ *$//')
if [ "$v" = false ]; then echo compliant; else echo "WBEM Enabled: ${v:-not reported}"; fi

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

Prerequisite Confirm monitoring/storage integrations do not require CIM/WBEM. If not required: 1. Disable WBEM/CIM using: esxcli system wbem set --enable false

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: vmwareesximanagement
Referencia: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.5 Host must deactivate CIM

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target vmware