Host should reject MAC address changes on standard virtual switches and port groups

Trung bìnhCấp 1Tự độngvmware

Mô tả

Enforcing MAC address stability on standard virtual switches and port groups prevents MAC impersonation by disallowing changes to the MAC address by virtual machines. This mitigates the risk of malicious activities initiated by impersonating authorized network adapters. The audit runs esxcli network vswitch standard (portgroup) policy security get for every standard vSwitch and port group and requires "Allow MAC Address Change: false". Runs in the ESXi Shell (busybox sh) as root.

Cách kiểm tra

Phương pháp kiểm tra: Lệnh shell

shell

command -v esxcli >/dev/null 2>&1 || exit 1
vs=$(esxcli network vswitch standard list 2>/dev/null | sed -n 's/^ *Name: *//p') || exit 1
pgs=$(esxcli --formatter=csv network vswitch standard portgroup list 2>/dev/null | awk -F, 'NR==1 {for (i = 1; i <= NF; i++) if ($i == "Name") c = i; next} c {print $c}') || exit 1
out=$(for v in $vs; do
  x=$(esxcli network vswitch standard policy security get -v "$v" 2>/dev/null | sed -n 's/^ *Allow MAC Address Change: *//p' | head -n 1)
  [ "$x" = false ] || echo "vSwitch $v: Allow MAC Address Change=${x:-unknown}"
done
printf '%s\n' "$pgs" | while IFS= read -r p; do [ -n "$p" ] || continue
  x=$(esxcli network vswitch standard portgroup policy security get -p "$p" 2>/dev/null | sed -n 's/^ *Allow MAC Address Change: *//p' | head -n 1)
  [ "$x" = false ] || echo "portgroup $p: Allow MAC Address Change=${x:-unknown}"
done)
[ -z "$out" ] && echo compliant || printf '%s\n' "$out"

Đầu ra mong đợi: compliant

Cách khắc phục

Phương pháp khắc phục: Hướng dẫn hoặc bản vá hạ tầng

To set the policy to reject, perform the following: 1. From the vSphere Web Client, select the host. 2. Click Configure then expand Networking. 3. Select Virtual switches then click Edit. 4. Click on Security. 5. Set MAC address changes to Reject in the dropdown. 6. Click on OK. Alternately, perform the following using the ESXi shell: # esxcli network vswitch standard policy security set -v vSwitch2 -m false

Thuộc tính

Hệ điều hành: Bất kỳ
Thẻ: vmwareesxinetwork
Tham chiếu: CIS VMware ESXi 8.0 Benchmark v1.4.0 - 5.7 Host should reject MAC address changes on standard virtual switches and port groups

Kiểm tra máy này

Chạy lệnh này trên máy bạn được phép kiểm tra. Lần quét chỉ ở chế độ đọc.

shell

tmaegis scan --target vmware