Host SSH daemon, if enabled, must display the system login banner before granting access

MoyenneNiveau 1Automatiséevmware

Description

Implementing a system login banner before granting SSH access ensures that crucial information or notices are conveyed to users attempting to login. The banner text is set through the host's Config.Etc.Issue advanced parameter. The audit reads /etc/ssh/sshd_config and requires a Banner directive pointing to a non-empty file. Runs in the ESXi Shell (busybox sh) as root.

Méthode de vérification

Méthode d'audit: Commande shell

shell

f=/etc/ssh/sshd_config; [ -r "$f" ] || exit 1
b=$(awk 'tolower($1)=="banner" {print $2; exit}' "$f")
case "$b" in ''|none) echo 'no SSH Banner configured'; exit 1 ;; esac
[ -s "$b" ] && echo compliant || echo "banner file $b is missing or empty"

Sortie attendue: compliant

Méthode de correction

Méthode de correction: Recommandation ou correctif d'infrastructure

To remediate this recommendation, configure the approved SSH banner file and Banner directive. Restart SSH only if enabled/authorized and confirm the banner appears before authentication.

Propriétés

Systèmes d'exploitation: Tous
Étiquettes: vmwareesxiservices
Référence: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 6.5.7 Host SSH daemon, if enabled, must display the system login banner before granting access

Vérifier cet hôte

Exécutez cette commande sur une machine que vous êtes autorisé à auditer. L'analyse est en lecture seule.

shell

tmaegis scan --target vmware