Host must configure a session timeout for the API

中レベル 1自動vmware

説明

A designated timeout ensures that sessions are not left open indefinitely, thereby reducing the exposure window for potential security threats. The parameter governing this behavior is Config.HostAgent.vmacore.soap.sessionTimeout with a recommended setting of 30 seconds. The audit reads Config.HostAgent.vmacore.soap.sessionTimeout with esxcli and requires the recommended 30 or less (0 disables the timeout and fails). Runs in the ESXi Shell (busybox sh) as root.

チェック方法

監査方法: シェルコマンド

shell

out=$(esxcli system settings advanced list -o /Config/HostAgent/vmacore/soap/sessionTimeout 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/Config/HostAgent/vmacore/soap/sessionTimeout: no integer value'; exit 1 ;; esac
if [ "$v" -gt 0 ] && [ "$v" -le 30 ]; then echo compliant; else echo "/Config/HostAgent/vmacore/soap/sessionTimeout = $v (expected 1-30)"; fi

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

1. Set the approved timeout with: Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.vmacore.soap.sessionTimeout | Set- AdvancedSetting -Value <seconds> -Confirm:$false 2. Validate administrative integrations after the change.

プロパティ

オペレーティングシステム: すべて
タグ: vmwareesximanagement
参照: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.16 Host must configure a session timeout for the API

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target vmware