TMA-ESXI9-3.8
Host must automatically terminate idle shells
설명
The host should be configured to automatically terminate idle shell sessions to prevent potential unauthorized access due to forgotten logouts. Setting a timeout for idle SSH connections ensures that any unattended sessions are closed, thereby reducing the security risk. The parameter governing this behavior is UserVars. The audit reads UserVars.ESXiShellInteractiveTimeOut with esxcli and requires 300 seconds or less (0 disables it and fails). Runs in the ESXi Shell (busybox sh) as root.
점검 방법
감사 방식: 셸 명령
out=$(esxcli system settings advanced list -o /UserVars/ESXiShellInteractiveTimeOut 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/UserVars/ESXiShellInteractiveTimeOut: no integer value'; exit 1 ;; esac
if [ "$v" -gt 0 ] && [ "$v" -le 300 ]; then echo compliant; else echo "/UserVars/ESXiShellInteractiveTimeOut = $v (expected 1-300)"; fi- 예상 출력
compliant
조치 방법
조치 방식: 가이드 또는 인프라 패치
To set the timeout to the desired value, perform the following from the vSphere web client: 1. From the vSphere Web Client, select the host. 2. Click Configure then expand System. 3. Select Advanced System Settings then click Edit. 4. Enter ESXiShellInteractiveTimeOut in the filter. 5. Set the value for this parameter is set to the appropriate value (300 seconds or less). 6. Click OK. Note: A value of 0 disables the ESXi ShellInteractiveTimeOut. Alternately, use the following PowerCLI command: # Set Remove UserVars.ESXiShellInteractiveTimeOut to 300 on all hosts Get-VMHost | Get-AdvancedSetting -Name 'UserVars.ESXiShellInteractiveTimeOut' | Set-AdvancedSetting -Value "300"
속성
- 운영 체제
- 모두
- 태그
- vmwareesximanagement
- 참고 자료
- CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.8 Host must automatically terminate idle shells
이 호스트 점검하기
감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.
tmaegis scan --target vmware