Host must configure a session timeout for the API

MediaNivel 1Automatizadavmware

Descripción

A designated timeout ensures that sessions are not left open indefinitely, thereby reducing the exposure window for potential security threats. The parameter governing this behavior is Config.HostAgent.vmacore.soap.sessionTimeout with a recommended setting of 30 seconds. The audit reads Config.HostAgent.vmacore.soap.sessionTimeout with esxcli and requires the recommended 30 or less (0 disables the timeout and fails). Runs in the ESXi Shell (busybox sh) as root.

Cómo se verifica

Método de auditoría: Comando de shell

shell

out=$(esxcli system settings advanced list -o /Config/HostAgent/vmacore/soap/sessionTimeout 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/Config/HostAgent/vmacore/soap/sessionTimeout: no integer value'; exit 1 ;; esac
if [ "$v" -gt 0 ] && [ "$v" -le 30 ]; then echo compliant; else echo "/Config/HostAgent/vmacore/soap/sessionTimeout = $v (expected 1-30)"; fi

Salida esperada: compliant

Cómo se corrige

Método de corrección: Guía o parche de infraestructura

1. Set the approved timeout with: Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.vmacore.soap.sessionTimeout | Set- AdvancedSetting -Value <seconds> -Confirm:$false 2. Validate administrative integrations after the change.

Propiedades

Sistemas operativos: Cualquiera
Etiquetas: vmwareesximanagement
Referencia: CIS VMware ESXi 8.0 Benchmark v1.4.0 - 3.16 Host must configure a session timeout for the API

Verificar este host

Ejecute esto en un equipo que tenga permiso para auditar. El escaneo es de solo lectura.

shell

tmaegis scan --target vmware