Host must automatically terminate idle host client sessions

MédiaNível 1Automatizadavmware

Descrição

Configuring the host to automatically terminate idle host client sessions helps mitigate security risks associated with unattended sessions, which could potentially be exploited. The recommended setting for this control is a timeout value of 900. The parameter governing this behavior is UserVars.HostClientSessionTimeout. The audit reads UserVars.HostClientSessionTimeout with esxcli and requires 900 seconds or less (0 = unlimited fails). Runs in the ESXi Shell (busybox sh) as root.

Como é verificado

Método de auditoria: Comando shell

shell

out=$(esxcli system settings advanced list -o /UserVars/HostClientSessionTimeout 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/UserVars/HostClientSessionTimeout: no integer value'; exit 1 ;; esac
if [ "$v" -gt 0 ] && [ "$v" -le 900 ]; then echo compliant; else echo "/UserVars/HostClientSessionTimeout = $v (expected 1-900)"; fi

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

1. Set the approved idle timeout with Get-VMHost | Get-AdvancedSetting -Name UserVars.HostClientSessionTimeout | Set-AdvancedSetting -Value <seconds> -Confirm:$false 2. Reconnect to the Host Client and confirm inactive sessions expire as expected.

Propriedades

Sistemas operacionais: Qualquer
Tags: vmwareesximanagement
Referência: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.17 Host must automatically terminate idle host client sessions

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target vmware