Host should reject forged transmits on standard virtual switches and port groups

SedangLevel 1Otomatisvmware

Deskripsi

Setting the "Forged transmits" option to "Reject" helps prevent MAC impersonation by comparing the source MAC address from the guest operating system with the effective MAC address of its virtual machine adapter. If there's a mismatch, the packet is dropped, preventing potential malicious activities through impersonated MAC addresses. The audit runs esxcli network vswitch standard (portgroup) policy security get for every standard vSwitch and port group and requires "Allow Forged Transmits: false". Runs in the ESXi Shell (busybox sh) as root.

Cara pemeriksaan

Metode audit: Perintah shell

shell

command -v esxcli >/dev/null 2>&1 || exit 1
vs=$(esxcli network vswitch standard list 2>/dev/null | sed -n 's/^ *Name: *//p') || exit 1
pgs=$(esxcli --formatter=csv network vswitch standard portgroup list 2>/dev/null | awk -F, 'NR==1 {for (i = 1; i <= NF; i++) if ($i == "Name") c = i; next} c {print $c}') || exit 1
out=$(for v in $vs; do
  x=$(esxcli network vswitch standard policy security get -v "$v" 2>/dev/null | sed -n 's/^ *Allow Forged Transmits: *//p' | head -n 1)
  [ "$x" = false ] || echo "vSwitch $v: Allow Forged Transmits=${x:-unknown}"
done
printf '%s\n' "$pgs" | while IFS= read -r p; do [ -n "$p" ] || continue
  x=$(esxcli network vswitch standard portgroup policy security get -p "$p" 2>/dev/null | sed -n 's/^ *Allow Forged Transmits: *//p' | head -n 1)
  [ "$x" = false ] || echo "portgroup $p: Allow Forged Transmits=${x:-unknown}"
done)
[ -z "$out" ] && echo compliant || printf '%s\n' "$out"

Output yang diharapkan: compliant

Cara perbaikan

Metode perbaikan: Panduan atau patch infrastruktur

To set the policy to reject forged transmissions, perform the following: 1. From the vSphere Web Client, select the host. 2. Click Configure then expand Networking. 3. Select Virtual switches then click Edit. 4. Click on Security. 5. Set Forged transmits to Reject in the dropdown. 6. Click on OK. Alternately, the following ESXi shell command may be used: # esxcli network vswitch standard policy security set -v vSwitch2 -f false

Properti

Sistem operasi: Apa saja
Tag: vmwareesxinetwork
Referensi: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 5.6 Host should reject forged transmits on standard virtual switches and port groups

Periksa host ini

Jalankan ini pada mesin yang diizinkan untuk Anda audit. Pemindaian bersifat hanya baca.

shell

tmaegis scan --target vmware