TMA-ESXI9-3.8
Host must automatically terminate idle shells
Opis
The host should be configured to automatically terminate idle shell sessions to prevent potential unauthorized access due to forgotten logouts. Setting a timeout for idle SSH connections ensures that any unattended sessions are closed, thereby reducing the security risk. The parameter governing this behavior is UserVars. The audit reads UserVars.ESXiShellInteractiveTimeOut with esxcli and requires 300 seconds or less (0 disables it and fails). Runs in the ESXi Shell (busybox sh) as root.
Kako se proverava
Metod provere: Komanda ljuske
out=$(esxcli system settings advanced list -o /UserVars/ESXiShellInteractiveTimeOut 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/UserVars/ESXiShellInteractiveTimeOut: no integer value'; exit 1 ;; esac
if [ "$v" -gt 0 ] && [ "$v" -le 300 ]; then echo compliant; else echo "/UserVars/ESXiShellInteractiveTimeOut = $v (expected 1-300)"; fi- Očekivani izlaz
compliant
Kako se ispravlja
Metod ispravke: Smernica ili zakrpa infrastrukture
To set the timeout to the desired value, perform the following from the vSphere web client: 1. From the vSphere Web Client, select the host. 2. Click Configure then expand System. 3. Select Advanced System Settings then click Edit. 4. Enter ESXiShellInteractiveTimeOut in the filter. 5. Set the value for this parameter is set to the appropriate value (300 seconds or less). 6. Click OK. Note: A value of 0 disables the ESXi ShellInteractiveTimeOut. Alternately, use the following PowerCLI command: # Set Remove UserVars.ESXiShellInteractiveTimeOut to 300 on all hosts Get-VMHost | Get-AdvancedSetting -Name 'UserVars.ESXiShellInteractiveTimeOut' | Set-AdvancedSetting -Value "300"
Svojstva
- Operativni sistemi
- Bilo koji
- Oznake
- vmwareesximanagement
- Referenca
- CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.8 Host must automatically terminate idle shells
Proverite ovaj računar
Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.
tmaegis scan --target vmware