Details
The Host Guest File System Server should be disabled if it is not needed.
*Rationale*
Certain automated operations such as automated tools upgrades use a component into the
hypervisor called Host Guest File System (HGFS) and an attacker could potentially use this
to transfer files inside the guest OS. These VMX parameters don’t apply on vSphere because
VMware virtual machines work on vSphere and hosted virtualization platforms such as
Workstation and Fusion. The code paths for these features are not implemented in ESXi.
Explicitly disabling these features reduces the potential for vulnerabilities because it
reduces the number of ways in which a guest can affect the host. Note that these are
implemented in code or not, must have a value.
Solution
To disable the Host Guest File System Server, run the following PowerCLI command:
# Add the setting to all VMs
Get-VM | New-AdvancedSetting -Name ‘isolation.tools.hgfsServerSet.disable’ -value
$true
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: System and Information Integrity.This control applies to the following type of system VMware.