Home
Security Hardening
DISA STIG VMware ESXi Server 5 STIG V2R1

DISA STIG VMware ESXi Server 5 STIG V2R1

GEN002140-ESXI5-000046 – All shells referenced in /etc/passwd must be listed in the /etc/shells file, except any shells specified for the purpose of preventing logins.
Details The shells file lists approved default shells. It helps provide layered defense to the security approach by ensuring users...
GEN002260-ESXI5-000047 – The system must be checked for extraneous device files at least weekly.
Details If an unauthorized device is allowed to exist on the system, there is the possibility the system may perform...
GEN002400-ESXI5-10047 – The system must be checked weekly for unauthorized setuid files, as well as, unauthorized modification to authorized setuid files.
Details Files with the setuid bit set will allow anyone running these files to be temporarily assigned the UID of...
GEN002420-ESXI5-00878 – Removable media, remote file systems, and any file system that does not contain approved setuid files must be mounted with the nosuid option.
Details The ‘nosuid’ mount option causes the system to not execute setuid files with owner privileges. This option must be...
GEN002430-ESXI5 – Removable media, remote file systems, and any file system that does not contain approved device files must be mounted with the nodev option.
Details The ‘nodev’ (or equivalent) mount option causes the system to not handle device files as system devices. This option...
GEN002460-ESXI5-20047 – The system must be checked weekly for unauthorized setgid files, as well as, unauthorized modification to authorized setgid files.
Details Files with the setgid bit set will allow anyone running these files to be temporarily assigned the GID of...
GEN003510-ESXI5-006660 – Kernel core dumps must be disabled unless needed.
Details Kernel core dumps may contain the full contents of system memory at the time of the crash. Kernel core...
GEN005300-ESXI5-000099 – SNMP communities, users, and passphrases must be changed from the default.
Details Whether active or inactive, default communities, users, and passwords must be changed to maintain security. A service running with...
GEN005440-ESXI5-000078 – The system must not be used as a syslog server (log host) for systems external to the enclave – log host for systems external to the enclave
Details Syslog messages are typically unencrypted and may contain sensitive information and are, therefore, restricted to the enclave. Solution Step...

DISA STIG VMware ESXi Server 5 STIG V2R1

GEN002140-ESXI5-000046 – All shells referenced in /etc/passwd must be listed in the /etc/shells file, except any shells specified for the purpose of preventing logins.

GEN002260-ESXI5-000047 – The system must be checked for extraneous device files at least weekly.

GEN002400-ESXI5-10047 – The system must be checked weekly for unauthorized setuid files, as well as, unauthorized modification to authorized setuid files.

GEN002420-ESXI5-00878 – Removable media, remote file systems, and any file system that does not contain approved setuid files must be mounted with the nosuid option.

GEN002430-ESXI5 – Removable media, remote file systems, and any file system that does not contain approved device files must be mounted with the nodev option.

GEN002460-ESXI5-20047 – The system must be checked weekly for unauthorized setgid files, as well as, unauthorized modification to authorized setgid files.

GEN003510-ESXI5-006660 – Kernel core dumps must be disabled unless needed.

GEN005300-ESXI5-000099 – SNMP communities, users, and passphrases must be changed from the default.

GEN005440-ESXI5-000078 – The system must not be used as a syslog server (log host) for systems external to the enclave – log host for systems external to the enclave