Host CIM services, if enabled, must limit access

OrtaDüzey 1Manuel incelemevmware

Açıklama

The Common Information Model (CIM) system allows for hardware-level management from remote applications through standard APIs. Ensuring only minimal access necessary to these applications is imperative to prevent potential security compromises. A dedicated service account, specific to each CIM application, should be created to limit access and privileges. Manual review: the check needs vCenter/PowerCLI, firmware or guest access, or an organization-specific value.

Nasıl denetlenir

Denetim yöntemi: Manuel inceleme

Bu öneri otomatik olarak denetlenemez. --include-manual parametresini verdiğinizde tarama bunu bu talimatlarla birlikte listeler.

To verify CIM access is limited, check for a limited-privileged service account with the following CIM roles applied: Host.Config.SystemManagement Host.CIM.CIMInteraction Alternately, the following PowerCLI command may be used: # List all user accounts on the Host -Host Local connection required- Get-VMHostAccount

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

To limit CIM access, perform the following: 1. Create a limited-privileged service account for CIM and other third-party applications. 2. This account should access the system via vCenter. 3. Give the account the CIM Interaction privilege only. This will enable the account to obtain a CIM ticket, which can then be used to perform both read and write CIM operations on the target host. If an account must connect to the host directly, this account must be granted the full "Administrator" role on the host. This is not recommended unless required by the monitoring software being used.

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: vmwareesxiservices
Referans: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 6.1.1 Host CIM services, if enabled, must limit access