TMA-ESXI9-3.14

Host must configure the password history setting to restrict the reuse of passwords

SrednjaNivo 1Automatskavmware

Opis

The goal is to inhibit the reuse of past passwords, acting as a deterrent against potential security breaches stemming from the exploitation of old, compromised credentials. This is achieved by configuring the Security.PasswordHistory parameter, which specifies the number of unique passwords a user must cycle through before a previous password can be reused. The audit reads Security.PasswordHistory with esxcli and requires 5. Runs in the ESXi Shell (busybox sh) as root.

Kako se proverava

Metod provere: Komanda ljuske

shell

out=$(esxcli system settings advanced list -o /Security/PasswordHistory 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/Security/PasswordHistory: no integer value'; exit 1 ;; esac
if [ "$v" -eq 5 ]; then echo compliant; else echo "/Security/PasswordHistory = $v (expected 5)"; fi

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

To set the password history 5, perform the following: 1. From the vSphere Web Client, select the host. 2. Click Configure then expand System. 3. Select Advanced System Settings then click Edit. 4. Enter Security.PasswordHistory in the filter. 5. Set the value for this parameter is set to 5. Alternately, the following PowerCLI command may be used: Get-VMHost | Get-AdvancedSetting Security.PasswordHistory | Set-AdvancedSetting - Value 5

Svojstva

Operativni sistemi: Bilo koji
Oznake: vmwareesximanagement
Referenca: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.14 Host must configure the password history setting to restrict the reuse of passwords

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target vmware