Virtual machines must require encryption for vMotion

SrednjaNivo 1Automatskavmware

Opis

Requiring encryption for vMotion ensures the secure transfer of data among virtual machines. While the default 'opportunistic' encryption setting generally provides encryption due to prevalent AES-NI support, enforcing 'required' encryption eradicates the possibility of unencrypted transfers. Expected: migrate.encryptionMode = "required". The audit parses every .vmx file under /vmfs/volumes/ on the host and lists the VMs that do not comply; it passes when none are found (or no VMs exist). Runs in the ESXi Shell (busybox sh) as root.

Kako se proverava

Metod provere: Komanda ljuske

shell

command -v find >/dev/null 2>&1 || exit 1
out=$(find /vmfs/volumes/ -maxdepth 3 -type f -name '*.vmx' 2>/dev/null | while IFS= read -r f; do
  awk -v KEYRE='^migrate[.]encryptionmode$' -v MODE='eq' -v VAL='required' 'BEGIN { re = tolower(KEYRE) }
{ line = $0; sub(/^[ \t]+/, "", line); i = index(line, "="); if (i == 0) next
  k = tolower(substr(line, 1, i - 1)); sub(/[ \t]+$/, "", k)
  v = substr(line, i + 1); sub(/^[ \t]*"?/, "", v); sub(/"?[ \t\r]*$/, "", v); v = tolower(v)
  if (k ~ re) { seen = 1; if (MODE == "not" && v == tolower(VAL)) bad = bad " " k "=" v
                else if (MODE != "not" && MODE != "ge" && v != tolower(VAL)) bad = bad " " k "=" v
                else if (MODE == "ge" && (v + 0) < (VAL + 0)) bad = bad " " k "=" v } }
END { if ((MODE == "eq" || MODE == "ge") && !seen) bad = " " KEYRE " not set"
      if (bad != "") print FILENAME ":" bad }' "$f"
done)
[ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 25

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

The following PowerCLI command may be used: $VMview = Get-VM -Name $VM | Get-View $ConfigSpec = New-Object VMware.Vim.VirtualMachineConfigSpec $ConfigSpec.MigrateEncryption = New-Object VMware.Vim.VirtualMachineConfigSpecEncryptedVMotionModes $ConfigSpec.MigrateEncryption = "required" $VMview.ReconfigVM_Task($ConfigSpec)

Svojstva

Operativni sistemi: Bilo koji
Oznake: vmwareesxivirtual-machine
Referenca: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 7.2 Virtual machines must require encryption for vMotion

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target vmware