Host must display a login banner for SSH connections

СреднийУровень 1Автоматическаяvmware

Описание

ESXi facilitates the display of a login message, primarily aimed to deter unauthorized access and inform legitimate users regarding system usage obligations, particularly during SSH connections. The text for this display is defined by a specific parameter, which is advisable to be configured, especially when SSH is active, albeit it's recommended to keep SSH in a stopped state ... The audit reads /etc/ssh/sshd_config and requires a Banner directive pointing to a non-empty file. Runs in the ESXi Shell (busybox sh) as root.

Как проверяется

Метод проверки: Команда оболочки

shell

f=/etc/ssh/sshd_config; [ -r "$f" ] || exit 1
b=$(awk 'tolower($1)=="banner" {print $2; exit}' "$f")
case "$b" in ''|none) echo 'no SSH Banner configured'; exit 1 ;; esac
[ -s "$b" ] && echo compliant || echo "banner file $b is missing or empty"

Ожидаемый вывод: compliant

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

1. Configure Banner /etc/issue in the SSH configuration and place the approved warning text in the referenced file. 2. Restart SSH only if it is authorized to be running; otherwise leave SSH disabled.

Свойства

Операционные системы: Любая
Теги: vmwareesximanagement
Источник: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.25 Host must display a login banner for SSH connections

Проверить этот хост

Выполните команду на компьютере, аудит которого вам разрешён. Сканирование работает только на чтение.

shell

tmaegis scan --target vmware