Host must deny shell access for the dcui account

보통레벨 1자동vmware

설명

The dcui account, utilized for process isolation for the Direct Console User Interface (DCUI), possesses shell access which, when deactivated, minimizes the attack surface. This action is a proactive measure to enhance system security. The audit runs esxcli system account list and requires Shell Access false for dcui. Runs in the ESXi Shell (busybox sh) as root.

점검 방법

감사 방식: 셸 명령

shell

out=$(esxcli system account list 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="dcui" {print tolower($NF); exit}')
case "$v" in false) echo compliant ;; '') echo 'dcui not listed (or no Shell Access column on this build)'; exit 1 ;; *) echo 'dcui shell access: '"$v" ;; esac

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

Configure the dcui service account to have no shell access using the supported ESXi account-management mechanism for the installed build, and verify that the account cannot establish an interactive shell. Note: It is advised not to manually edit /etc/passwd unless directed by Broadcom support.

속성

운영 체제: 모두
태그: vmwareesximanagement
참고 자료: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.22 Host must deny shell access for the dcui account

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target vmware