Host must verify certificates for TLS remote logging endpoints

SrednjaNivo 1Automatskavmware

Opis

When engaging in remote logging activities, it is of utmost importance to ensure that the logging endpoint is genuine and secure. To achieve this, hosts should verify the TLS certificates of these endpoints. This verification provides assurance that the endpoint is both authentic and trustworthy, mitigating the risk of transmitting logs to potentially malicious or untrusted ... The audit reads Syslog.global.certificate.checkSSLCerts with esxcli and requires true (1). Runs in the ESXi Shell (busybox sh) as root.

Kako se proverava

Metod provere: Komanda ljuske

shell

out=$(esxcli system settings advanced list -o /Syslog/global/certificate/checkSSLCerts 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/Syslog/global/certificate/checkSSLCerts: no integer value'; exit 1 ;; esac
if [ "$v" -eq 1 ]; then echo compliant; else echo "/Syslog/global/certificate/checkSSLCerts = $v (expected true/1)"; fi

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Execute command: esxcli system syslog config set --check-ssl- certs=true Verify with: esxcli system syslog config get remediated result should include: ssl://

Svojstva

Operativni sistemi: Bilo koji
Oznake: vmwareesxilogging
Referenca: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 4.10 Host must verify certificates for TLS remote logging endpoints

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target vmware