Host must configure a session timeout for the API

SrednjaNivo 1Automatskavmware

Opis

A designated timeout ensures that sessions are not left open indefinitely, thereby reducing the exposure window for potential security threats. The parameter governing this behavior is Config.HostAgent.vmacore.soap.sessionTimeout with a recommended setting of 30 seconds. The audit reads Config.HostAgent.vmacore.soap.sessionTimeout with esxcli and requires the recommended 30 or less (0 disables the timeout and fails). Runs in the ESXi Shell (busybox sh) as root.

Kako se proverava

Metod provere: Komanda ljuske

shell

out=$(esxcli system settings advanced list -o /Config/HostAgent/vmacore/soap/sessionTimeout 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/Config/HostAgent/vmacore/soap/sessionTimeout: no integer value'; exit 1 ;; esac
if [ "$v" -gt 0 ] && [ "$v" -le 30 ]; then echo compliant; else echo "/Config/HostAgent/vmacore/soap/sessionTimeout = $v (expected 1-30)"; fi

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

1. Set the approved timeout with: Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.vmacore.soap.sessionTimeout | Set- AdvancedSetting -Value <seconds> -Confirm:$false 2. Validate administrative integrations after the change.

Svojstva

Operativni sistemi: Bilo koji
Oznake: vmwareesximanagement
Referenca: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.16 Host must configure a session timeout for the API

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target vmware