Host must configure the password history setting to restrict the reuse of passwords

СредњаНиво 1Аутоматскаvmware

Опис

The goal is to inhibit the reuse of past passwords, acting as a deterrent against potential security breaches stemming from the exploitation of old, compromised credentials. This is achieved by configuring the Security.PasswordHistory parameter, which specifies the number of unique passwords a user must cycle through before a previous password can be reused. The audit reads Security.PasswordHistory with esxcli and requires 5. Runs in the ESXi Shell (busybox sh) as root.

Како се проверава

Метод провере: Команда љуске

shell

out=$(esxcli system settings advanced list -o /Security/PasswordHistory 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/Security/PasswordHistory: no integer value'; exit 1 ;; esac
if [ "$v" -eq 5 ]; then echo compliant; else echo "/Security/PasswordHistory = $v (expected 5)"; fi

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

To set the password history 5, perform the following: 1. From the vSphere Web Client, select the host. 2. Click Configure then expand System. 3. Select Advanced System Settings then click Edit. 4. Enter Security.PasswordHistory in the filter. 5. Set the value for this parameter is set to 5. Alternately, the following PowerCLI command may be used: Get-VMHost | Get-AdvancedSetting Security.PasswordHistory | Set-AdvancedSetting - Value 5

Својства

Оперативни системи: Било који
Ознаке: vmwareesximanagement
Референца: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.14 Host must configure the password history setting to restrict the reuse of passwords

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target vmware