Host must automatically terminate idle DCUI sessions

보통레벨 1자동vmware

설명

By configuring a session timeout, unattended console sessions are automatically terminated, thereby reducing the potential security risks associated with lingering active sessions. The parameter governing this behavior is UserVars.DcuiTimeOut, with a recommended setting of 600 (10 minutes). The audit reads UserVars.DcuiTimeOut with esxcli and requires 600 seconds or less (0 disables the timeout and fails). Runs in the ESXi Shell (busybox sh) as root.

점검 방법

감사 방식: 셸 명령

shell

out=$(esxcli system settings advanced list -o /UserVars/DcuiTimeOut 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/UserVars/DcuiTimeOut: no integer value'; exit 1 ;; esac
if [ "$v" -gt 0 ] && [ "$v" -le 600 ]; then echo compliant; else echo "/UserVars/DcuiTimeOut = $v (expected 1-600)"; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

To correct the DCUI timeout setting, perform the following steps: 1. From the vSphere Web Client, select the host. 2. Click Configure, then under System select Advanced System Settings. 3. Select Edit then enter UserVars.DcuiTimeOut in the filter. 4. Click in the box for the current value, then set the value to 600 seconds or less. Alternately, use the following PowerCLI command: Get-VMHost | Get-AdvancedSetting -Name UserVars.DcuiTimeOut | Set-AdvancedSetting -Value 600

속성

운영 체제: 모두
태그: vmwareesximanagement
참고 자료: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.7 Host must automatically terminate idle DCUI sessions

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target vmware