Host SNMP services, if enabled, must limit access

보통레벨 1수동 검토vmware

설명

To manage hosts securely, if SNMP is enabled, access must be restricted. Preferably, SNMPv3 should be employed as it offers superior security through key authentication and encryption compared to SNMPv1 or SNMPv2. Configuring the destination for SNMP traps is essential for ensuring monitoring data is directed to a legitimate and secure host. Manual review: the check needs vCenter/PowerCLI, firmware or guest access, or an organization-specific value.

점검 방법

감사 방식: 수동 검토

이 권장 사항은 자동으로 점검할 수 없습니다. --include-manual 옵션을 전달하면 스캔 결과에 이 지침과 함께 표시됩니다.

To confirm the proper configuration of SNMP, perform the following from the ESXi Shell or vCLI: 1. Run the following to determine if SNMP is being used: esxcli system snmp get 2. If SNMP is being used, refer to the vSphere Monitoring and Performance guide, chapter 8 for steps to verify the parameters. Additionally, the following PowerCLI command may be used to view the SNMP configuration: # List the SNMP Configuration of a host (single host connection required) Get-VMHostSnmp

조치 방법

조치 방식: 가이드 또는 인프라 패치

To correct the SNMP configuration, perform the following from the ESXi Shell or vCLI: 1. If SNMP is not needed, disable it by running: esxcli system snmp set --enable false 2. If SNMP is needed, refer to the vSphere Monitoring and Performance guide, chapter 8 for steps to configure it. Additionally, the following PowerCLI command may be used to implement the configuration: # Update the host SNMP Configuration (single host connection required) Get-VmHostSNMP | Set-VMHostSNMP -Enabled:$true -ReadOnlyCommunity '<secret>' Notes: SNMP must be configured on each ESXi host SNMP settings can be configured using Host Profiles

속성

운영 체제: 모두
태그: vmwareesxiservices
참고 자료: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 6.4.1 Host SNMP services, if enabled, must limit access