Details
Unrestricted access to services running on an ESXi host can expose a host to outside attacks and unauthorized access. Reduce the risk by configuring the ESXi firewall to only allow access from authorized networks.
NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.
Solution
From the vSphere Web Client select the ESXi Host and go to Configure >> System >> Security Profile. Under the Firewall section click Edit and for each enabled service uncheck the check box to ‘Allow connections from any IP address,’ and input the site specific network(s) required.Configure this for Incoming and Outgoing connections.
or
From a PowerCLI command prompt while connected to the ESXi host run the following command:
$esxcli = Get-EsxCli
#This disables the allow all rule for the target service
$esxcli.network.firewall.ruleset.set($false,$true,’sshServer’)
$esxcli.network.firewall.ruleset.allowedip.add(‘192.168.0.0/24′,’sshServer’)
This must be done for each enabled service.
Supportive Information
The following resource is also helpful.
This security hardening control applies to the following category of controls within NIST 800-53: Configuration Management.This control applies to the following type of system Unix.
References
- 800-53|CM-6b.
- CAT|II
- CCI|CCI-000366
- Rule-ID|SV-207655r388482_rule
- STIG-ID|ESXI-65-000056
- STIG-Legacy|SV-104145
- STIG-Legacy|V-94059
- Vuln-ID|V-207655