VMware ESXi
TMA-ESXI9-3.10
Host must not suppress warnings that the shell is enabled
Açıklama
Having warnings for enabled SSH or ESXi Shell provides insight into potential security risks. Disabling such warnings can mask ongoing attacks. The parameter governing this behavior is UserVars.SuppressShellWarning with a recommended value of 0. The audit reads UserVars.SuppressShellWarning with esxcli and requires 0. Runs in the ESXi Shell (busybox sh) as root.
Nasıl denetlenir
Denetim yöntemi: Kabuk komutu
out=$(esxcli system settings advanced list -o /UserVars/SuppressShellWarning 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/UserVars/SuppressShellWarning: no integer value'; exit 1 ;; esac
if [ "$v" -eq 0 ]; then echo compliant; else echo "/UserVars/SuppressShellWarning = $v (expected 0)"; fi- Beklenen çıktı
compliant
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
From an administrative PowerCLI session. 1. Execute Get-VMHost | Get-AdvancedSetting -Name UserVars.SuppressShellWarning | Set-AdvancedSetting -Value 0 -Confirm:$false 2. Shell access should normally remain disabled; do not suppress the warning when it is enabled.
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- vmwareesximanagement
- Referans
- CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.10 Host must not suppress warnings that the shell is enabled
Bu ana makineyi denetle
Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.
tmaegis scan --target vmware