VMware ESXi
TMA-ESXI9-6.4.1
Host SNMP services, if enabled, must limit access
Mô tả
To manage hosts securely, if SNMP is enabled, access must be restricted. Preferably, SNMPv3 should be employed as it offers superior security through key authentication and encryption compared to SNMPv1 or SNMPv2. Configuring the destination for SNMP traps is essential for ensuring monitoring data is directed to a legitimate and secure host. Manual review: the check needs vCenter/PowerCLI, firmware or guest access, or an organization-specific value.
Cách kiểm tra
Phương pháp kiểm tra: Xem xét thủ công
To confirm the proper configuration of SNMP, perform the following from the ESXi Shell or vCLI: 1. Run the following to determine if SNMP is being used: esxcli system snmp get 2. If SNMP is being used, refer to the vSphere Monitoring and Performance guide, chapter 8 for steps to verify the parameters. Additionally, the following PowerCLI command may be used to view the SNMP configuration: # List the SNMP Configuration of a host (single host connection required) Get-VMHostSnmp
Cách khắc phục
Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng
To correct the SNMP configuration, perform the following from the ESXi Shell or vCLI: 1. If SNMP is not needed, disable it by running: esxcli system snmp set --enable false 2. If SNMP is needed, refer to the vSphere Monitoring and Performance guide, chapter 8 for steps to configure it. Additionally, the following PowerCLI command may be used to implement the configuration: # Update the host SNMP Configuration (single host connection required) Get-VmHostSNMP | Set-VMHostSNMP -Enabled:$true -ReadOnlyCommunity '<secret>' Notes: SNMP must be configured on each ESXi host SNMP settings can be configured using Host Profiles
Thuộc tính
- Hệ điều hành
- Bất kỳ
- Thẻ
- vmwareesxiservices
- Tham chiếu
- CIS VMware ESXi 9.0 Benchmark v1.0.0 - 6.4.1 Host SNMP services, if enabled, must limit access