Host must restrict use of the dvFilter network API

보통레벨 1자동vmware

설명

The Net.DVFilterBindIpAddress parameter controls the use of the dvFilter network API, allowing network information to be sent to a specified IP address. If enabled with a compromised IP address, unauthorized network access to other virtual machines on the host could occur. It's essential to keep this parameter unconfigured, unless required by a product like VMware NSX. The audit reads Net.DVFilterBindIpAddress with esxcli and requires an empty value (set it only when a dvfilter security appliance is used). Runs in the ESXi Shell (busybox sh) as root.

점검 방법

감사 방식: 셸 명령

shell

out=$(esxcli system settings advanced list -o /Net/DVFilterBindIpAddress 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | sed -n 's/^ *String Value: *//p' | head -n 1)
if [ -z "$v" ]; then echo compliant; else echo "/Net/DVFilterBindIpAddress = '$v' (expected empty)"; fi

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

To remove the configuration for the dvfilter network API, perform the following from the vSphere web client: 1. From the vSphere web client, select the host and click Configure then expand System 2. Click on Advanced System Settings then Edit. 3. Search for Net.DVFilterBindIpAddress in the filter. 4. Set Net.DVFilterBindIpAddress has an empty value. 5. If an appliance is being used, make sure the value of this parameter is set to the proper IP address. 6. Enter the proper IP address. 7. Click OK.

속성

운영 체제: 모두
태그: vmwareesxinetwork
참고 자료: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 5.3 Host must restrict use of the dvFilter network API

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target vmware