Home
Security Hardening
DISA STIG VMware vSphere 6.7 ESXi V1R1

DISA STIG VMware vSphere 6.7 ESXi V1R1

ESXI-67-000038 – ESXi hosts using Host Profiles and/or Auto Deploy must use the vSphere Authentication Proxy to protect passwords when adding themselves to Active Directory.
Details If a host is configured to join an Active Directory domain using Host Profiles and/or Auto Deploy, the Active...
ESXI-67-000039 – Active Directory ESX Admin group membership must not be used when adding ESXi hosts to Active Directory.
Details When adding ESXi hosts to Active Directory (AD), all user/group accounts assigned to the AD group ‘ESX Admins’ will...
ESXI-67-000030 – The ESXi host must produce audit records containing information to establish what type of events occurred.
Details Without establishing what types of events occurred, it would be difficult to establish, correlate, and investigate the events leading...
ESXI-67-000031 – The ESXi host must enforce password complexity by requiring that at least one uppercase character be used.
Details To enforce the use of complex passwords, minimum numbers of characters of different classes are mandated. The use of...
ESXI-67-000032 – The ESXi host must prohibit the reuse of passwords within five iterations.
Details If a user or root used the same password continuously or was allowed to change it back shortly after...
ESXI-67-000034 – The ESXi host must disable the Managed Object Browser (MOB).
Details The MOB provides a way to explore the object model used by the VMkernel to manage the host and...
ESXI-67-000035 – The ESXi host must be configured to disable nonessential capabilities by disabling SSH.
Details The ESXi Shell is an interactive command line interface (CLI) available at the ESXi server console. The ESXi shell...
ESXI-67-000036 – The ESXi host must disable ESXi Shell unless needed for diagnostics or troubleshooting.
Details The ESXi Shell is an interactive command line environment available locally from the DCUI or remotely via SSH. Activities...
ESXI-67-000057 – The ESXi host must configure the firewall to block network traffic by default – incoming
Details In addition to service-specific firewall rules, ESXi has a default firewall rule policy to allow or deny incoming and...
ESXI-67-000057 – The ESXi host must configure the firewall to block network traffic by default – outgoing
Details In addition to service-specific firewall rules, ESXi has a default firewall rule policy to allow or deny incoming and...

Prev Next

DISA STIG VMware vSphere 6.7 ESXi V1R1

ESXI-67-000038 – ESXi hosts using Host Profiles and/or Auto Deploy must use the vSphere Authentication Proxy to protect passwords when adding themselves to Active Directory.

ESXI-67-000039 – Active Directory ESX Admin group membership must not be used when adding ESXi hosts to Active Directory.

ESXI-67-000030 – The ESXi host must produce audit records containing information to establish what type of events occurred.

ESXI-67-000031 – The ESXi host must enforce password complexity by requiring that at least one uppercase character be used.

ESXI-67-000032 – The ESXi host must prohibit the reuse of passwords within five iterations.

ESXI-67-000034 – The ESXi host must disable the Managed Object Browser (MOB).

ESXI-67-000035 – The ESXi host must be configured to disable nonessential capabilities by disabling SSH.

ESXI-67-000036 – The ESXi host must disable ESXi Shell unless needed for diagnostics or troubleshooting.

ESXI-67-000057 – The ESXi host must configure the firewall to block network traffic by default – incoming

ESXI-67-000057 – The ESXi host must configure the firewall to block network traffic by default – outgoing