Host hardware must enable and configure a TPM 2.0

보통레벨 1자동vmware

설명

ESXi can use Trusted Platform Modules (TPM) 2.0 to enable advanced security features that prevent malware, remove dependencies, and secure hardware lifecycle operations. The audit runs esxcli hardware trustedboot get and requires "Tpm Present: true"; TPM attestation alarms are still reviewed in vCenter. Runs in the ESXi Shell (busybox sh) as root.

점검 방법

감사 방식: 셸 명령

shell

out=$(esxcli hardware trustedboot get 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk -F': *' 'tolower($1) ~ /^ *tpm present$/ {print $2; exit}' | tr 'A-Z' 'a-z' | sed 's/ *$//')
if [ "$v" = true ]; then echo compliant; else echo "Tpm Present: ${v:-not reported}"; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

1. Place the host in maintenance mode. 2. reboot into BIOS/UEFI. 3. Enable and activate the TPM 4. Select TPM 2.0 mode, and ensure UEFI/Secure Boot prerequisites required by the server vendor are enabled. 5. Save changes. 6. reboot with command reboot 7. Verify again with esxcli hardware trustedboot get and esxcli system settings encryption get.

속성

운영 체제: 모두
태그: vmwareesxihardware
참고 자료: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 1.4 Host hardware must enable and configure a TPM 2.0

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target vmware