Host iSCSI client, if enabled, must employ bidirectional/mutual CHAP authentication

보통레벨 1자동vmware

설명

Implementing bidirectional CHAP authentication for iSCSI connections elevates security by necessitating mutual verification between the initiator (client) and target (server), ensuring data integrity during transmission. Configuration involves setting the iSCSI storage adapter authentication to "Use bidirectional CHAP" and providing the requisite credentials. The audit lists iSCSI adapters (esxcli iscsi adapter list) and requires CHAP level "required" in both uni and mutual directions on each; with no iSCSI adapters the rule passes. Runs in the ESXi Shell (busybox sh) as root.

점검 방법

감사 방식: 셸 명령

shell

out=$(esxcli iscsi adapter list 2>/dev/null) || exit 1
ad=$(printf '%s\n' "$out" | awk 'NR > 2 && $1 ~ /^vmhba/ {print $1}')
bad=''
for a in $ad; do
  u=$(esxcli iscsi adapter auth chap get -A "$a" -d uni 2>/dev/null | sed -n 's/^ *Level: *//p' | head -n 1)
  m=$(esxcli iscsi adapter auth chap get -A "$a" -d mutual 2>/dev/null | sed -n 's/^ *Level: *//p' | head -n 1)
  [ "$u" = required ] && [ "$m" = required ] || bad="$bad $a(uni=${u:-?},mutual=${m:-?})"
done
[ -z "$bad" ] && echo compliant || echo "iSCSI adapters without bidirectional CHAP:$bad"

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

To enable bidirectional CHAP authentication for iSCSI traffic, perform the following: 1. From the vSphere Web Client, select the host. 2. Click Configure then expand Storage. 3. Select Storage Adapters then select the iSCSI Adapter. 4. Under Properties click on Edit next to Authentication. 5. Next to Authentication Method select Use bidirectional CHAP from the dropdown. 6. Specify the outgoing CHAP name. Make sure that the name you specify matches the name configured on the storage side. To set the CHAP name to the iSCSI adapter name, select "Use initiator name".

속성

운영 체제: 모두
태그: vmwareesxiservices
참고 자료: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 6.3.1 Host iSCSI client, if enabled, must employ bidirectional/mutual CHAP authentication

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target vmware