Host SSH daemon, if enabled, must display the system login banner before granting access

보통레벨 1자동vmware

설명

Implementing a system login banner before granting SSH access ensures that crucial information or notices are conveyed to users attempting to login. The banner text is set through the host's Config.Etc.Issue advanced parameter. The audit reads /etc/ssh/sshd_config and requires a Banner directive pointing to a non-empty file. Runs in the ESXi Shell (busybox sh) as root.

점검 방법

감사 방식: 셸 명령

shell

f=/etc/ssh/sshd_config; [ -r "$f" ] || exit 1
b=$(awk 'tolower($1)=="banner" {print $2; exit}' "$f")
case "$b" in ''|none) echo 'no SSH Banner configured'; exit 1 ;; esac
[ -s "$b" ] && echo compliant || echo "banner file $b is missing or empty"

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

To remediate this recommendation, configure the approved SSH banner file and Banner directive. Restart SSH only if enabled/authorized and confirm the banner appears before authentication.

속성

운영 체제: 모두
태그: vmwareesxiservices
참고 자료: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 6.5.7 Host SSH daemon, if enabled, must display the system login banner before granting access

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target vmware