Host should deactivate SSH

CaoCấp 1Tự độngvmware

Mô tả

Secure Shell (SSH) provides remote access to the ESXi shell, enabling direct host console access or remote connectivity. Deactivating SSH is a security measure aimed at minimizing remote access channels to the ESXi host, restricting it to essential connections only through vSphere Client, vCLI/PowerCLI, or published APIs. The audit parses vim-cmd hostsvc/hostconfig for the TSM-SSH service and requires startup policy "off" (start and stop manually) and the service not running. When tmaegis itself connects over SSH this rule reports the running service; scan from the ESXi Shell/DCUI instead. Runs in the ESXi Shell (busybox sh) as root.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

out=$(vim-cmd hostsvc/hostconfig 2>/dev/null) || exit 1
p=$(printf '%s\n' "$out" | awk '/key = "TSM-SSH"/{f=1} f && $1=="policy" {v=$3; gsub(/[",]/, "", v); print v; exit}')
r=$(printf '%s\n' "$out" | awk '/key = "TSM-SSH"/{f=1} f && $1=="running" {v=$3; gsub(/[",]/, "", v); print v; exit}')
[ -n "$p" ] || { echo 'TSM-SSH: service not found in hostconfig'; exit 1; }
if [ "$p" = off ] && [ "$r" != true ]; then echo compliant; else echo "TSM-SSH: policy=$p running=$r"; fi

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

To disable SSH, perform the following: 1. From the vSphere Web Client, select the host. 2. Select Configure then expand System and select Services. 3. Click on SSH then click Edit Startup Policy. 4. Set the Startup Policy is set to Start and Stop Manually. 5. Click OK. 6. While ESXi Shell is still selected click Stop. Alternately, use the following PowerCLI command: # Set SSH to start manually rather than automatically for all hosts Get-VMHost | Get-VMHostService | Where { $_.key -eq "TSM-SSH" } | Set- VMHostService -Policy Off

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: vmwareesximanagement
Tham chiếu: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.1 Host should deactivate SSH

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target vmware