Host must restrict use of the dvFilter network API

СредњаНиво 1Аутоматскаvmware

Опис

The Net.DVFilterBindIpAddress parameter controls the use of the dvFilter network API, allowing network information to be sent to a specified IP address. If enabled with a compromised IP address, unauthorized network access to other virtual machines on the host could occur. It's essential to keep this parameter unconfigured, unless required by a product like VMware NSX. The audit reads Net.DVFilterBindIpAddress with esxcli and requires an empty value (set it only when a dvfilter security appliance is used). Runs in the ESXi Shell (busybox sh) as root.

Како се проверава

Метод провере: Команда љуске

shell

out=$(esxcli system settings advanced list -o /Net/DVFilterBindIpAddress 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | sed -n 's/^ *String Value: *//p' | head -n 1)
if [ -z "$v" ]; then echo compliant; else echo "/Net/DVFilterBindIpAddress = '$v' (expected empty)"; fi

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

To remove the configuration for the dvfilter network API, perform the following from the vSphere web client: 1. From the vSphere web client, select the host and click Configure then expand System 2. Click on Advanced System Settings then Edit. 3. Search for Net.DVFilterBindIpAddress in the filter. 4. Set Net.DVFilterBindIpAddress has an empty value. 5. If an appliance is being used, make sure the value of this parameter is set to the proper IP address. 6. Enter the proper IP address. 7. Click OK.

Својства

Оперативни системи: Било који
Ознаке: vmwareesxinetwork
Референца: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 5.3 Host must restrict use of the dvFilter network API

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target vmware