Host SSH daemon, if enabled, must display the system login banner before granting access

MediaNivel 1Automatizadavmware

Descripción

Implementing a system login banner before granting SSH access ensures that crucial information or notices are conveyed to users attempting to login. The banner text is set through the host's Config.Etc.Issue advanced parameter. The audit reads /etc/ssh/sshd_config and requires a Banner directive pointing to a non-empty file. Runs in the ESXi Shell (busybox sh) as root.

Cómo se verifica

Método de auditoría: Comando de shell

shell

f=/etc/ssh/sshd_config; [ -r "$f" ] || exit 1
b=$(awk 'tolower($1)=="banner" {print $2; exit}' "$f")
case "$b" in ''|none) echo 'no SSH Banner configured'; exit 1 ;; esac
[ -s "$b" ] && echo compliant || echo "banner file $b is missing or empty"

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

To remediate this recommendation, configure the approved SSH banner file and Banner directive. Restart SSH only if enabled/authorized and confirm the banner appears before authentication.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: vmwareesxiservices
Referencia: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 6.5.7 Host SSH daemon, if enabled, must display the system login banner before granting access

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target vmware