Host must enforce password complexity

ВисокаНиво 1Аутоматскаvmware

Опис

The enforcement of password complexity is managed through the Security.PasswordQualityControl parameter, allowing configuration of password length, character set requirements, and failed logon attempt restrictions. The recommended setting is "retry=3 min=disabled,15,15,15,15 max=64 similar=deny passphrase=3". The audit reads Security.PasswordQualityControl with esxcli and requires min=disabled,disabled,disabled,disabled,N with N of 15 or more. Runs in the ESXi Shell (busybox sh) as root.

Како се проверава

Метод провере: Команда љуске

shell

out=$(esxcli system settings advanced list -o /Security/PasswordQualityControl 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | sed -n 's/^ *String Value: *//p' | head -n 1)
m=$(printf '%s\n' "$v" | tr ' ' '\n' | sed -n 's/^min=//p' | head -n 1)
[ -n "$m" ] || { echo "no min= in '$v'"; exit 1; }
printf '%s\n' "$m" | awk -F, '{ if (NF == 5 && $1 == "disabled" && $2 == "disabled" && $3 == "disabled" && $4 == "disabled" && $5 ~ /^[0-9]+$/ && $5 + 0 >= 15) print "compliant"; else print "min=" $0 }'

Очекивани излаз: compliant

Како се исправља

Метод исправке: Смерница или закрпа инфраструктуре

To set the password complexity requirements, perform the following PowerCLI command: Get-VMHOST | Get-AdvancedSetting -Name "Security.PasswordQualityControl" | Set-AdvancedSetting -Value "retry=3 min=disabled,disabled,disabled,disabled,15" The above requires all passwords to be 15 or more characters long and comprised of at least one character from four distinct character sets.

Својства

Оперативни системи: Било који
Ознаке: vmwareesximanagement
Референца: CIS VMware ESXi 8.0 Benchmark v1.4.0 - 3.11 Host must enforce password complexity

Проверите овај рачунар

Покрените ово на рачунару за који имате дозволу за проверу. Скенирање ради у режиму само за читање.

shell

tmaegis scan --target vmware