VMware ESXi
TMA-ESXI9-1.3
Host hardware must enable Intel TXT, if available
Descrição
Intel Xeon Scalable Processor platforms have Trusted Execution Technology, or TXT, that help harden systems against malware, rootkits, BIOS & firmware attacks, and more. When enabled, ESXi will take advantage of security benefits offered by this technology. Manual review: the check needs vCenter/PowerCLI, firmware or guest access, or an organization-specific value.
Como é verificado
Método de auditoria: Revisão manual
1. Execute: esxcli hardware trustedboot get 2. For hardware that supports Intel Trusted Execution Technology, verify: Drtm Enabled: true Tpm Present: true Note: If Drtm Enabled is false, determine whether Intel TXT is supported by the host hardware and firmware. If TXT is supported but not enabled, the host is not compliant.
Como é corrigido
Método de correção: Orientação ou patch de infraestrutura
Place the ESXi host into maintenance mode and reboot the physical server. Enter the system BIOS/UEFI configuration and enable TPM 2.0 and Intel Trusted Execution Technology (TXT), where supported. Save the firmware configuration and perform a full reboot.
Propriedades
- Sistemas operacionais
- Qualquer
- Tags
- vmwareesxihardware
- Referência
- CIS VMware ESXi 9.0 Benchmark v1.0.0 - 1.3 Host hardware must enable Intel TXT, if available