VMware ESXi
TMA-ESXI9-3.2
Host must deactivate the ESXi shell
Mô tả
The ESXi shell is an interactive command line environment available from the Direct Console User Interface (DCUI) or remotely via SSH. Activities performed from the ESXi Shell bypass all access controls, but are logged. The recommended setting for the ESXi shell is to be stopped and only started manually when needed, such as when running diagnostics or troubleshooting. The audit parses vim-cmd hostsvc/hostconfig for the TSM (ESXi Shell) service and requires startup policy "off" and the service not running. Runs in the ESXi Shell (busybox sh) as root.
Cách kiểm tra
Phương pháp kiểm tra: Lệnh shell
out=$(vim-cmd hostsvc/hostconfig 2>/dev/null) || exit 1
p=$(printf '%s\n' "$out" | awk '/key = "TSM"/{f=1} f && $1=="policy" {v=$3; gsub(/[",]/, "", v); print v; exit}')
r=$(printf '%s\n' "$out" | awk '/key = "TSM"/{f=1} f && $1=="running" {v=$3; gsub(/[",]/, "", v); print v; exit}')
[ -n "$p" ] || { echo 'TSM: service not found in hostconfig'; exit 1; }
if [ "$p" = off ] && [ "$r" != true ]; then echo compliant; else echo "TSM: policy=$p running=$r"; fi- Đầu ra mong đợi
compliant
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
To disable the ESXi shell, perform the following: 1. From the vSphere Web Client, select the host. 2. Select Configure then expand System and select Services. 3. Click on ESXi Shell then click Edit Startup Policy. 4. Set the Startup Policy is set to Start and Stop Manually. 5. Click on OK. Alternately, use the following PowerCLI command: # Set the ESXi shell to start manually rather than automatically for all hosts Get-VMHost | Get-VMHostService | Where { $_.key -eq "TSM" } | Set-VMHostService - Policy Off
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- vmwareesximanagement
- Tham chiếu
- CIS VMware ESXi 9.0 Benchmark v1.0.0 - 3.2 Host must deactivate the ESXi shell
Kiểm tra máy này
Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.
tmaegis scan --target vmware