Host iSCSI client, if enabled, must employ bidirectional/mutual CHAP authentication

中レベル 1自動vmware

説明

Implementing bidirectional CHAP authentication for iSCSI connections elevates security by necessitating mutual verification between the initiator (client) and target (server), ensuring data integrity during transmission. Configuration involves setting the iSCSI storage adapter authentication to "Use bidirectional CHAP" and providing the requisite credentials. The audit lists iSCSI adapters (esxcli iscsi adapter list) and requires CHAP level "required" in both uni and mutual directions on each; with no iSCSI adapters the rule passes. Runs in the ESXi Shell (busybox sh) as root.

チェック方法

監査方法: シェルコマンド

shell

out=$(esxcli iscsi adapter list 2>/dev/null) || exit 1
ad=$(printf '%s\n' "$out" | awk 'NR > 2 && $1 ~ /^vmhba/ {print $1}')
bad=''
for a in $ad; do
  u=$(esxcli iscsi adapter auth chap get -A "$a" -d uni 2>/dev/null | sed -n 's/^ *Level: *//p' | head -n 1)
  m=$(esxcli iscsi adapter auth chap get -A "$a" -d mutual 2>/dev/null | sed -n 's/^ *Level: *//p' | head -n 1)
  [ "$u" = required ] && [ "$m" = required ] || bad="$bad $a(uni=${u:-?},mutual=${m:-?})"
done
[ -z "$bad" ] && echo compliant || echo "iSCSI adapters without bidirectional CHAP:$bad"

期待される出力: compliant

修正方法

修正方法: ガイダンスまたは IaC パッチ

To enable bidirectional CHAP authentication for iSCSI traffic, perform the following: 1. From the vSphere Web Client, select the host. 2. Click Configure then expand Storage. 3. Select Storage Adapters then select the iSCSI Adapter. 4. Under Properties click on Edit next to Authentication. 5. Next to Authentication Method select Use bidirectional CHAP from the dropdown. 6. Specify the outgoing CHAP name. Make sure that the name you specify matches the name configured on the storage side. To set the CHAP name to the iSCSI adapter name, select "Use initiator name".

プロパティ

オペレーティングシステム: すべて
タグ: vmwareesxiservices
参照: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 6.3.1 Host iSCSI client, if enabled, must employ bidirectional/mutual CHAP authentication

このホストをチェック

監査が許可されているマシンで実行してください。スキャンは読み取り専用です。

shell

tmaegis scan --target vmware