Host must deactivate CIM

MoyenneNiveau 1Automatiséevmware

Description

Deactivating the Common Information Model (CIM) service, when not in use, aligns with the principle of minimizing the attack surface by disabling non-essential services. This action helps in reducing the potential vectors of attack, thus bolstering the host's security posture. The audit runs esxcli system wbem get and requires "Enabled: false". Document an exception when CIM is required. Runs in the ESXi Shell (busybox sh) as root.

Méthode de vérification

Méthode d'audit: Commande shell

shell

out=$(esxcli system wbem get 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk -F': *' 'tolower($1) ~ /^ *enabled$/ {print $2; exit}' | tr 'A-Z' 'a-z' | sed 's/ *$//')
if [ "$v" = false ]; then echo compliant; else echo "WBEM Enabled: ${v:-not reported}"; fi

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

Prerequisite Confirm monitoring/storage integrations do not require CIM/WBEM. If not required: 1. Disable WBEM/CIM using: esxcli system wbem set --enable false

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: vmwareesximanagement
Référence: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.5 Host must deactivate CIM

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target vmware