TMAegis
vmware için daha fazla kural

TMA-ESXI9-3.8

Host must automatically terminate idle shells

OrtaDüzey 1Otomatikvmware

Açıklama

The host should be configured to automatically terminate idle shell sessions to prevent potential unauthorized access due to forgotten logouts. Setting a timeout for idle SSH connections ensures that any unattended sessions are closed, thereby reducing the security risk. The parameter governing this behavior is UserVars. The audit reads UserVars.ESXiShellInteractiveTimeOut with esxcli and requires 300 seconds or less (0 disables it and fails). Runs in the ESXi Shell (busybox sh) as root.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell
out=$(esxcli system settings advanced list -o /UserVars/ESXiShellInteractiveTimeOut 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/UserVars/ESXiShellInteractiveTimeOut: no integer value'; exit 1 ;; esac
if [ "$v" -gt 0 ] && [ "$v" -le 300 ]; then echo compliant; else echo "/UserVars/ESXiShellInteractiveTimeOut = $v (expected 1-300)"; fi
Beklenen çıktı
compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

To set the timeout to the desired value, perform the following from the vSphere web client: 1. From the vSphere Web Client, select the host. 2. Click Configure then expand System. 3. Select Advanced System Settings then click Edit. 4. Enter ESXiShellInteractiveTimeOut in the filter. 5. Set the value for this parameter is set to the appropriate value (300 seconds or less). 6. Click OK. Note: A value of 0 disables the ESXi ShellInteractiveTimeOut. Alternately, use the following PowerCLI command: # Set Remove UserVars.ESXiShellInteractiveTimeOut to 300 on all hosts Get-VMHost | Get-AdvancedSetting -Name 'UserVars.ESXiShellInteractiveTimeOut' | Set-AdvancedSetting -Value "300"

Özellikler

İşletim sistemleri
Herhangi biri
Etiketler
vmwareesximanagement
Referans
CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.8 Host must automatically terminate idle shells

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell
tmaegis scan --target vmware