Host firewall must only allow traffic from authorized networks

AltaNivel 1Automatizadavmware

Descripción

The host's firewall is designed to block all incoming and outgoing network traffic by default, unless exceptions are explicitly made, thus minimizing the attack surface and barring unauthorized access. The firewall settings, while simplistic, are akin to router ACLs, and might require reflexive rules to be configured for certain network scenarios. The audit lists enabled firewall rulesets (esxcli network firewall ruleset list) and fails any whose allowed IP list (ruleset allowedip list) is All; confirm the configured ranges are the authorized networks. Runs in the ESXi Shell (busybox sh) as root.

Cómo se verifica

Método de auditoría: Comando de shell

shell

en=$(esxcli network firewall ruleset list 2>/dev/null | awk 'NR > 2 && $2 == "true" {print $1}') || exit 1
all=$(esxcli network firewall ruleset allowedip list 2>/dev/null | awk 'NR > 2 && $2 == "All" {print $1}') || exit 1
bad=''
for r in $en; do for a in $all; do [ "$r" = "$a" ] && bad="$bad $r"; done; done
[ -z "$bad" ] && echo compliant || echo "enabled rulesets allowing all IPs:$bad"

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

To properly restrict access to services running on an ESXi host, perform the following from the vSphere web client: 1. Select a host 2. Click Configure then expand System then select Firewall. 3. Click Edit to view services which are enabled (indicated by a check). 4. For each enabled service, (e.g., ssh, vSphere Web Access, http client) provide a list of allowed IP addresses. 5. Click OK.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: vmwareesxinetwork
Referencia: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 5.1 Host firewall must only allow traffic from authorized networks

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target vmware