Details
Monitor exposed configuration files to verify no unauthorized modifications have been made.
*Rationale*
Although most configurations on ESXi are controlled via an API, there are a limited set of
configuration files that are used directly to govern host behavior. These specific files are
exposed via the vSphere HTTPS-based file transfer API. Any changes to these files should
be correlated with an approved administrative action, such as an authorized configuration
change. Tampering with these files has the potential to enable unauthorized access to the
host configuration and virtual machines.
WARNING- do not attempt to monitor files that are NOT exposed via this file-transfer API,
since this can result in a destabilized system
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
During a configuration backup, the serial number is backed up with the configuration. The
number is restored when you restore the configuration. The number is not preserved when
you run the Recovery CD (ESXi Embedded) or perform a repair operation (ESXi Installable).
You can back up and restore configuration information as follows.
1. Back up the configuration by using the vicfg-cfgbackup command.
2. Run the Recovery CD or repair operation
3. Restore the configuration by using the vicfg-cfgbackup command.When you restore a configuration, you must make sure that all virtual machines on the host
are stopped.Impact-After you configure an ESXi host, you can back up the host configuration data. Always back
up your host configuration after you change the configuration or upgrade the ESXi image.
Important The vicfg-cfgbackup command is available only for ESXi hosts. The command is
not available through a vCenter Server system connection. No equivalent ESXCLI command
is supported.
Supportive Information
The following resource is also helpful.
This control applies to the following type of system VMware.