Host must restrict use of the dvFilter network API

OrtaDüzey 1Otomatikvmware

Açıklama

The Net.DVFilterBindIpAddress parameter controls the use of the dvFilter network API, allowing network information to be sent to a specified IP address. If enabled with a compromised IP address, unauthorized network access to other virtual machines on the host could occur. It's essential to keep this parameter unconfigured, unless required by a product like VMware NSX. The audit reads Net.DVFilterBindIpAddress with esxcli and requires an empty value (set it only when a dvfilter security appliance is used). Runs in the ESXi Shell (busybox sh) as root.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

out=$(esxcli system settings advanced list -o /Net/DVFilterBindIpAddress 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | sed -n 's/^ *String Value: *//p' | head -n 1)
if [ -z "$v" ]; then echo compliant; else echo "/Net/DVFilterBindIpAddress = '$v' (expected empty)"; fi

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

To remove the configuration for the dvfilter network API, perform the following from the vSphere web client: 1. From the vSphere web client, select the host and click Configure then expand System 2. Click on Advanced System Settings then Edit. 3. Search for Net.DVFilterBindIpAddress in the filter. 4. Set Net.DVFilterBindIpAddress has an empty value. 5. If an appliance is being used, make sure the value of this parameter is set to the proper IP address. 6. Enter the proper IP address. 7. Click OK.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: vmwareesxinetwork
Referans: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 5.3 Host must restrict use of the dvFilter network API

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target vmware