Home
Security Hardening
DISA STIG VMware vSphere 6.7 ESXi V1R1

DISA STIG VMware vSphere 6.7 ESXi V1R1

ESXI-67-000058 – The ESXi host must enable BPDU filter on the host to prevent being locked out of physical switch ports with Portfast and BPDU Guard enabled.
Details BPDU Guard and Portfast are commonly enabled on the physical switch to which the ESXi host is directly connected...
ESXI-67-000040 – The ESXi host must use multifactor authentication for local DCUI access to privileged accounts.
Details To ensure accountability and prevent unauthenticated access, privileged users must utilize multifactor authentication to prevent potential misuse and compromise...
ESXI-67-000059 – The virtual switch Forged Transmits policy must be set to reject on the ESXi host.
Details If the virtual machine operating system changes the MAC address, the operating system can send frames with an impersonated...
ESXI-67-000041 – The ESXi host must set a timeout to automatically disable idle shell sessions after two minutes.
Details If a user forgets to log out of their local or remote ESXi Shell session, the idle connection will...
ESXI-67-000042 – The ESXi host must terminate shell services after 10 minutes.
Details When the ESXi Shell or SSH services are enabled on a host, they will run indefinitely. To avoid having...
ESXI-67-000043 – The ESXi host must log out of the console UI after two minutes.
Details When the direct console user interface (DCUI) is enabled and logged in, it should be automatically logged out if...
ESXI-67-000045 – The ESXi host must enable a persistent log location for all locally stored logs.
Details ESXi can be configured to store log files on an in-memory file system. This occurs when the host’s ‘/scratch’...
ESXI-67-000046 – The ESXi host must configure NTP time synchronization.
Details To ensure the accuracy of the system clock, it must be synchronized with an authoritative time source within DoD....
ESXI-67-000048 – The ESXi host must protect the confidentiality and integrity of transmitted information by isolating vMotion traffic.
Details While encrypted vMotion is available now, vMotion traffic should still be sequestered from other traffic to further protect it...
ESXI-67-000049 – The ESXi host must protect the confidentiality and integrity of transmitted information by protecting ESXi management traffic.
Details The vSphere management network provides access to the vSphere management interface on each component. Services running on the management...

Prev Next

DISA STIG VMware vSphere 6.7 ESXi V1R1

ESXI-67-000058 – The ESXi host must enable BPDU filter on the host to prevent being locked out of physical switch ports with Portfast and BPDU Guard enabled.

ESXI-67-000040 – The ESXi host must use multifactor authentication for local DCUI access to privileged accounts.

ESXI-67-000059 – The virtual switch Forged Transmits policy must be set to reject on the ESXi host.

ESXI-67-000041 – The ESXi host must set a timeout to automatically disable idle shell sessions after two minutes.

ESXI-67-000042 – The ESXi host must terminate shell services after 10 minutes.

ESXI-67-000043 – The ESXi host must log out of the console UI after two minutes.

ESXI-67-000045 – The ESXi host must enable a persistent log location for all locally stored logs.

ESXI-67-000046 – The ESXi host must configure NTP time synchronization.

ESXI-67-000048 – The ESXi host must protect the confidentiality and integrity of transmitted information by isolating vMotion traffic.

ESXI-67-000049 – The ESXi host must protect the confidentiality and integrity of transmitted information by protecting ESXi management traffic.