Host hardware must enable Intel TXT, if available

中レベル 1手動レビューvmware

説明

Intel Xeon Scalable Processor platforms have Trusted Execution Technology, or TXT, that help harden systems against malware, rootkits, BIOS & firmware attacks, and more. When enabled, ESXi will take advantage of security benefits offered by this technology. Manual review: the check needs vCenter/PowerCLI, firmware or guest access, or an organization-specific value.

チェック方法

監査方法: 手動レビュー

この推奨事項は自動ではチェックできません。--include-manual を指定すると、スキャン結果にこの手順付きで一覧表示されます。

1. Execute: esxcli hardware trustedboot get 2. For hardware that supports Intel Trusted Execution Technology, verify: Drtm Enabled: true Tpm Present: true Note: If Drtm Enabled is false, determine whether Intel TXT is supported by the host hardware and firmware. If TXT is supported but not enabled, the host is not compliant.

修正方法

修正方法: ガイダンスまたは IaC パッチ

Place the ESXi host into maintenance mode and reboot the physical server. Enter the system BIOS/UEFI configuration and enable TPM 2.0 and Intel Trusted Execution Technology (TXT), where supported. Save the firmware configuration and perform a full reboot.

プロパティ

オペレーティングシステム: すべて
タグ: vmwareesxihardware
参照: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 1.3 Host hardware must enable Intel TXT, if available