Details
The CIM system provides an interface that enables hardware-level management from remote applications via a set of standard APIs. Create a limited-privilege, read-only service account for CIM. Grant this role to the user on the ESXi server. Place this user in the Exception Users list. When/where write access is required, create/enable a limited-privilege, service account and grant only the minimum required privileges.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
Create a role for the CIM account.
From the Host Client, go to manage, then Security & Users. Select Roles then click Add Role. Provide a name for the new role then select Host >> Cim >> Ciminteraction and click Add.
Add a CIM user account.
From the Host Client, go to manage, then Security & Users. Select Users then click Add User. Provide a name, description, and password for the new user then click Add.
Assign the CIM account permissions to the host with the new role.
From the Host Client, select the ESXi host, right click and go to ‘Permissions’. Click Add User and select the CIM account from the drop down list and select the new CIM role from the drop down list and click Add User.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system VMware.
References
- 800-53|CM-6b.
- CAT|II
- CCI|CCI-000366
- Rule-ID|SV-207668r388482_rule
- STIG-ID|ESXI-65-000070
- STIG-Legacy|SV-104303
- STIG-Legacy|V-94349
- Vuln-ID|V-207668