TMA-ESXI9-3.11
Host must enforce password complexity
Açıklama
The enforcement of password complexity is managed through the Security.PasswordQualityControl parameter, allowing configuration of password length, character set requirements, and failed logon attempt restrictions. The recommended setting is "retry=3 min=disabled,15,15,15,15 max=64 similar=deny passphrase=3". The audit reads Security.PasswordQualityControl with esxcli and requires min=disabled,disabled,disabled,disabled,N with N of 15 or more. Runs in the ESXi Shell (busybox sh) as root.
Nasıl denetlenir
Denetim yöntemi: Kabuk komutu
out=$(esxcli system settings advanced list -o /Security/PasswordQualityControl 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | sed -n 's/^ *String Value: *//p' | head -n 1)
m=$(printf '%s\n' "$v" | tr ' ' '\n' | sed -n 's/^min=//p' | head -n 1)
[ -n "$m" ] || { echo "no min= in '$v'"; exit 1; }
printf '%s\n' "$m" | awk -F, '{ if (NF == 5 && $1 == "disabled" && $2 == "disabled" && $3 == "disabled" && $4 == "disabled" && $5 ~ /^[0-9]+$/ && $5 + 0 >= 15) print "compliant"; else print "min=" $0 }'- Beklenen çıktı
compliant
Nasıl düzeltilir
Düzeltme yöntemi: Kılavuz veya altyapı yaması
To set the password complexity requirements, perform the following PowerCLI command: Get-VMHOST | Get-AdvancedSetting -Name "Security.PasswordQualityControl" | Set- AdvancedSetting -Value "retry=3 min=disabled,disabled,disabled,disabled,15" The above requires all passwords to be 15 or more characters long and comprised of at least one character from four distinct character sets.
Özellikler
- İşletim sistemleri
- Herhangi biri
- Etiketler
- vmwareesximanagement
- Referans
- CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.11 Host must enforce password complexity
Bu ana makineyi denetle
Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.
tmaegis scan --target vmware