Host must configure a session timeout for the API

SedangLevel 1Otomatisvmware

Deskripsi

A designated timeout ensures that sessions are not left open indefinitely, thereby reducing the exposure window for potential security threats. The parameter governing this behavior is Config.HostAgent.vmacore.soap.sessionTimeout with a recommended setting of 30 seconds. The audit reads Config.HostAgent.vmacore.soap.sessionTimeout with esxcli and requires the recommended 30 or less (0 disables the timeout and fails). Runs in the ESXi Shell (busybox sh) as root.

Cara pemeriksaan

Metode audit: Perintah shell

shell

out=$(esxcli system settings advanced list -o /Config/HostAgent/vmacore/soap/sessionTimeout 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/Config/HostAgent/vmacore/soap/sessionTimeout: no integer value'; exit 1 ;; esac
if [ "$v" -gt 0 ] && [ "$v" -le 30 ]; then echo compliant; else echo "/Config/HostAgent/vmacore/soap/sessionTimeout = $v (expected 1-30)"; fi

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

1. Set the approved timeout with: Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.vmacore.soap.sessionTimeout | Set- AdvancedSetting -Value <seconds> -Confirm:$false 2. Validate administrative integrations after the change.

Properti

Sistem operasi: Apa saja
Tag: vmwareesximanagement
Referensi: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.16 Host must configure a session timeout for the API

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target vmware