Host SSH daemon, if enabled, must use FIPS 140-2/140-3 validated cryptographic modules

СреднийУровень 1Ручная проверкаvmware

Описание

When enabled, the SSH daemon on the host should employ FIPS 140-2/140-3 validated cryptographic modules provided by OpenSSH. Although these modules are enabled by default, they can be deactivated for backward compatibility, thus auditing and ensuring the correct setting is crucial for maintaining security standards. Manual review: the check needs vCenter/PowerCLI, firmware or guest access, or an organization-specific value.

Как проверяется

Метод проверки: Ручная проверка

Эту рекомендацию нельзя проверить автоматически. Сканирование выводит её вместе с этими инструкциями при указании флага --include-manual.

Verify ESXi is operating with Broadcom-supported cryptographic modules and that SSH is using the platform-provided OpenSSH/crypto libraries. Review installed VIBs and do not accept replacement third-party SSH/crypto binaries.

Как исправляется

Метод исправления: Рекомендация или патч инфраструктуры

To remediate this recommendation, remove unsupported SSH/cryptographic binaries and restore the signed ESXi components from an approved image/profile. Keep ESXi patched so the validated cryptographic modules remain current.

Свойства

Операционные системы: Любая
Теги: vmwareesxiservices
Источник: CIS VMware ESXi 8.0 Benchmark v1.4.0 - 6.5.2 Host SSH daemon, if enabled, must use FIPS 140-2/140-3 validated cryptographic modules