Host must verify certificates for TLS remote logging endpoints

MédiaNível 1Automatizadavmware

Descrição

When engaging in remote logging activities, it is of utmost importance to ensure that the logging endpoint is genuine and secure. To achieve this, hosts should verify the TLS certificates of these endpoints. This verification provides assurance that the endpoint is both authentic and trustworthy, mitigating the risk of transmitting logs to potentially malicious or untrusted ... The audit reads Syslog.global.certificate.checkSSLCerts with esxcli and requires true (1). Runs in the ESXi Shell (busybox sh) as root.

Como é verificado

Método de auditoria: Comando shell

shell

out=$(esxcli system settings advanced list -o /Syslog/global/certificate/checkSSLCerts 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/Syslog/global/certificate/checkSSLCerts: no integer value'; exit 1 ;; esac
if [ "$v" -eq 1 ]; then echo compliant; else echo "/Syslog/global/certificate/checkSSLCerts = $v (expected true/1)"; fi

Saída esperada: compliant

Como é corrigido

Método de correção: Orientação ou patch de infraestrutura

Execute command: esxcli system syslog config set --check-ssl-certs=true Verify with: esxcli system syslog config get remediated result should include: ssl://

Propriedades

Sistemas operacionais: Qualquer
Tags: vmwareesxilogging
Referência: CIS VMware ESXi 8.0 Benchmark v1.4.0 - 4.10 Host must verify certificates for TLS remote logging endpoints

Verificar este host

Execute isto em uma máquina que você tenha permissão para auditar. A varredura é somente leitura.

shell

tmaegis scan --target vmware