Host must lock an account after a specified number of failed login attempts

Trung bìnhCấp 1Tự độngvmware

Mô tả

The security control involves restricting account access following a specified number of failed login attempts, acting as a deterrent against brute-force attacks. This control is applicable for SSH and vSphere Web Services SDK access, though not for the Direct Console Interface (DCUI) and the ESXi Shell. The audit reads Security.AccountLockFailures with esxcli and requires 5. Runs in the ESXi Shell (busybox sh) as root.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

out=$(esxcli system settings advanced list -o /Security/AccountLockFailures 2>/dev/null) || exit 1
v=$(printf '%s\n' "$out" | awk '$1=="Int" && $2=="Value:" {print $3; exit}')
case "$v" in ''|*[!0-9-]*) echo '/Security/AccountLockFailures: no integer value'; exit 1 ;; esac
if [ "$v" -eq 5 ]; then echo compliant; else echo "/Security/AccountLockFailures = $v (expected 5)"; fi

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

To set the maximum failed login attempts correctly, perform the following steps: 1. From the vSphere Web Client, select the host. 2. Click Configure then expand System. 3. Select Advanced System Settings then click Edit. 4. Enter Security.AccountLockFailures in the filter. 5. Set the value for this parameter to 5. Alternately, use the following PowerCLI command: Get-VMHost | Get-AdvancedSetting -Name Security.AccountLockFailures | Set- AdvancedSetting -Value 5

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: vmwareesximanagement
Tham chiếu: CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.12 Host must lock an account after a specified number of failed login attempts

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target vmware