Virtual machines must require encryption for vMotion

OrtaDüzey 1Otomatikvmware

Açıklama

Requiring encryption for vMotion ensures the secure transfer of data among virtual machines. While the default 'opportunistic' encryption setting generally provides encryption due to prevalent AES-NI support, enforcing 'required' encryption eradicates the possibility of unencrypted transfers. Expected: migrate.encryptionMode = "required". The audit parses every .vmx file under /vmfs/volumes/ on the host and lists the VMs that do not comply; it passes when none are found (or no VMs exist). Runs in the ESXi Shell (busybox sh) as root.

Nasıl denetlenir

Denetim yöntemi: Kabuk komutu

shell

command -v find >/dev/null 2>&1 || exit 1
out=$(find /vmfs/volumes/ -maxdepth 3 -type f -name '*.vmx' 2>/dev/null | while IFS= read -r f; do
  awk -v KEYRE='^migrate[.]encryptionmode$' -v MODE='eq' -v VAL='required' 'BEGIN { re = tolower(KEYRE) }
{ line = $0; sub(/^[ \t]+/, "", line); i = index(line, "="); if (i == 0) next
  k = tolower(substr(line, 1, i - 1)); sub(/[ \t]+$/, "", k)
  v = substr(line, i + 1); sub(/^[ \t]*"?/, "", v); sub(/"?[ \t\r]*$/, "", v); v = tolower(v)
  if (k ~ re) { seen = 1; if (MODE == "not" && v == tolower(VAL)) bad = bad " " k "=" v
                else if (MODE != "not" && MODE != "ge" && v != tolower(VAL)) bad = bad " " k "=" v
                else if (MODE == "ge" && (v + 0) < (VAL + 0)) bad = bad " " k "=" v } }
END { if ((MODE == "eq" || MODE == "ge") && !seen) bad = " " KEYRE " not set"
      if (bad != "") print FILENAME ":" bad }' "$f"
done)
[ -z "$out" ] && echo compliant || printf '%s\n' "$out" | head -n 25

Beklenen çıktı: compliant

Nasıl düzeltilir

Düzeltme yöntemi: Kılavuz veya altyapı yaması

The following PowerCLI command may be used: $VMview = Get-VM -Name $VM | Get-View $ConfigSpec = New-Object VMware.Vim.VirtualMachineConfigSpec $ConfigSpec.MigrateEncryption = New-Object VMware.Vim.VirtualMachineConfigSpecEncryptedVMotionModes $ConfigSpec.MigrateEncryption = "required" $VMview.ReconfigVM_Task($ConfigSpec)

Özellikler

İşletim sistemleri: Herhangi biri
Etiketler: vmwareesxivirtual-machine
Referans: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 7.2 Virtual machines must require encryption for vMotion

Bu ana makineyi denetle

Bunu denetleme izniniz olan bir makinede çalıştırın. Tarama salt okunurdur.

shell

tmaegis scan --target vmware