VMware ESXi
TMA-ESXI9-5.3
Host must restrict use of the dvFilter network API
Descrição
The Net.DVFilterBindIpAddress parameter controls the use of the dvFilter network API, allowing network information to be sent to a specified IP address. If enabled with a compromised IP address, unauthorized network access to other virtual machines on the host could occur. It's essential to keep this parameter unconfigured, unless required by a product like VMware NSX. The audit reads Net.DVFilterBindIpAddress with esxcli and requires an empty value (set it only when a dvfilter security appliance is used). Runs in the ESXi Shell (busybox sh) as root.
Como é verificado
Método de auditoria: Comando shell
out=$(esxcli system settings advanced list -o /Net/DVFilterBindIpAddress 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | sed -n 's/^ *String Value: *//p' | head -n 1)
if [ -z "$v" ]; then echo compliant; else echo "/Net/DVFilterBindIpAddress = '$v' (expected empty)"; fi- Saída esperada
compliant
Como é corrigido
Método de correção: Orientação ou patch de infraestrutura
To remove the configuration for the dvfilter network API, perform the following from the vSphere web client: 1. From the vSphere web client, select the host and click Configure then expand System 2. Click on Advanced System Settings then Edit. 3. Search for Net.DVFilterBindIpAddress in the filter. 4. Set Net.DVFilterBindIpAddress has an empty value. 5. If an appliance is being used, make sure the value of this parameter is set to the proper IP address. 6. Enter the proper IP address. 7. Click OK.
Propriedades
- Sistemas operacionais
- Qualquer
- Tags
- vmwareesxinetwork
- Referência
- CIS VMware ESXi 9.0 Benchmark v1.0.0 - 5.3 Host must restrict use of the dvFilter network API
Verificar este host
Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.
tmaegis scan --target vmware