VMware ESXi
TMA-ESXI9-3.14
Host must configure the password history setting to restrict the reuse of passwords
Описание
The goal is to inhibit the reuse of past passwords, acting as a deterrent against potential security breaches stemming from the exploitation of old, compromised credentials. This is achieved by configuring the Security.PasswordHistory parameter, which specifies the number of unique passwords a user must cycle through before a previous password can be reused. The audit reads Security.PasswordHistory with esxcli and requires 5. Runs in the ESXi Shell (busybox sh) as root.
Как проверяется
Метод проверки: Команда оболочки
out=$(esxcli system settings advanced list -o /Security/PasswordHistory 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/Security/PasswordHistory: no integer value'; exit 1 ;; esac
if [ "$v" -eq 5 ]; then echo compliant; else echo "/Security/PasswordHistory = $v (expected 5)"; fi- Ожидаемый вывод
compliant
Как исправляется
Метод исправления: Рекомендация или патч инфраструктуры
To set the password history 5, perform the following: 1. From the vSphere Web Client, select the host. 2. Click Configure then expand System. 3. Select Advanced System Settings then click Edit. 4. Enter Security.PasswordHistory in the filter. 5. Set the value for this parameter is set to 5. Alternately, the following PowerCLI command may be used: Get-VMHost | Get-AdvancedSetting Security.PasswordHistory | Set-AdvancedSetting - Value 5
Свойства
- Операционные системы
- Любая
- Теги
- vmwareesximanagement
- Источник
- CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.14 Host must configure the password history setting to restrict the reuse of passwords
Проверить этот хост
Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.
tmaegis scan --target vmware