Host firewall must only allow traffic from authorized networks

TinggiLevel 1Otomatisvmware

Deskripsi

The host's firewall is designed to block all incoming and outgoing network traffic by default, unless exceptions are explicitly made, thus minimizing the attack surface and barring unauthorized access. The firewall settings, while simplistic, are akin to router ACLs, and might require reflexive rules to be configured for certain network scenarios. The audit lists enabled firewall rulesets (esxcli network firewall ruleset list) and fails any whose allowed IP list (ruleset allowedip list) is All; confirm the configured ranges are the authorized networks. Runs in the ESXi Shell (busybox sh) as root.

Cara pemeriksaan

Metode audit: Perintah shell

shell

en=$(esxcli network firewall ruleset list 2>/dev/null | awk 'NR > 2 && $2 == "true" {print $1}') || exit 1
all=$(esxcli network firewall ruleset allowedip list 2>/dev/null | awk 'NR > 2 && $2 == "All" {print $1}') || exit 1
bad=''
for r in $en; do for a in $all; do [ "$r" = "$a" ] && bad="$bad $r"; done; done
[ -z "$bad" ] && echo compliant || echo "enabled rulesets allowing all IPs:$bad"

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

To properly restrict access to services running on an ESXi host, perform the following from the vSphere web client: 1. Select a host 2. Click Configure then expand System then select Firewall. 3. Click Edit to view services which are enabled (indicated by a check). 4. For each enabled service, (e.g., ssh, vSphere Web Access, http client) provide a list of allowed IP addresses. 5. Click OK.

Properti

Sistem operasi: Apa saja
Tag: vmwareesxinetwork
Referensi: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 5.1 Host firewall must only allow traffic from authorized networks

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target vmware