Virtual machines must prevent unauthorized connection of devices

보통레벨 1자동vmware

설명

In a virtual machine, users and processes without root or administrator privileges can connect devices, such as network adapters and CD-ROM drives. This should be prevented. Expected: isolation.device.connectable.disable = "TRUE". The audit parses every .vmx file under /vmfs/volumes/ on the host and lists the VMs that do not comply; it passes when none are found (or no VMs exist). Runs in the ESXi Shell (busybox sh) as root.

점검 방법

감사 방식: 셸 명령

shell

command -v find >/dev/null 2>&1 || exit 1
out=$(find /vmfs/volumes/ -maxdepth 3 -type f -name '*.vmx' 2>/dev/null | while IFS= read -r f; do
  awk -v KEYRE='^isolation[.]device[.]connectable[.]disable$' -v MODE='eq' -v VAL='TRUE' 'BEGIN { re = tolower(KEYRE) }
{ line = $0; sub(/^[ \t]+/, "", line); i = index(line, "="); if (i == 0) next
  k = tolower(substr(line, 1, i - 1)); sub(/[ \t]+$/, "", k)
  v = substr(line, i + 1); sub(/^[ \t]*"?/, "", v); sub(/"?[ \t\r]*$/, "", v); v = tolower(v)
  if (k ~ re) { seen = 1; if (MODE == "not" && v == tolower(VAL)) bad = bad " " k "=" v
                else if (MODE != "not" && MODE != "ge" && v != tolower(VAL)) bad = bad " " k "=" v
                else if (MODE == "ge" && (v + 0) < (VAL + 0)) bad = bad " " k "=" v } }
END { if ((MODE == "eq" || MODE == "ge") && !seen) bad = " " KEYRE " not set"
      if (bad != "") print FILENAME ":" bad }' "$f"
done)
[ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 25

예상 출력: compliant

조치 방법

조치 방식: 가이드 또는 인프라 패치

To prevent unauthorized device connections, run the following PowerCLI command: # Add the setting to all VMs Get-VM | New-AdvancedSetting -Name "isolation.device.connectable.disable" -value $true

속성

운영 체제: 모두
태그: vmwareesxivirtual-machine
참고 자료: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 7.9 Virtual machines must prevent unauthorized connection of devices

이 호스트 점검하기

감사 권한이 있는 시스템에서 실행하세요. 스캔은 읽기 전용입니다.

shell

tmaegis scan --target vmware