Home
Security Hardening
DISA STIG VMware vSphere 6.x ESXi V1R5

DISA STIG VMware vSphere 6.x ESXi V1R5

ESXI-06-000001 – The VMM must limit the number of concurrent sessions to ten for all accounts and/or account types by enabling lockdown mode.
Details Enabling lockdown mode disables direct access to an ESXi host requiring the host be managed remotely from vCenter Server....
ESXI-06-000002 – The system must verify the DCUI.Access list.
Details Lockdown mode disables direct host access requiring that admins manage hosts from vCenter Server. However, if a host becomes...
ESXI-06-000003 – The system must verify the exception users list for lockdown mode.
Details In vSphere 6.0 and later, you can add users to the Exception Users list from the vSphere Web Client....
ESXI-06-000004 – Remote logging for ESXi hosts must be configured.
Details Remote logging to a central log host provides a secure, centralized store for ESXi logs. By gathering host log...
ESXI-06-000005 – The system must enforce the limit of three consecutive invalid logon attempts by a user.
Details By limiting the number of failed login attempts, the risk of unauthorized access via user password guessing, otherwise known...
ESXI-06-000006 – The system must enforce the unlock timeout of 15 minutes after a user account is locked out.
Details By limiting the number of failed login attempts, the risk of unauthorized access via user password guessing, otherwise known...
ESXI-06-000007 – The system must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.
Details Failure to display the DoD logon banner prior to a log in attempt will negate legal proceedings resulting from...
ESXI-06-000008 – The SSH daemon must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.
Details Failure to display the DoD logon banner prior to a log in attempt will negate legal proceedings resulting from...
ESXI-06-000040 – The system must use multifactor authentication for local access to privileged accounts.
Details To assure accountability and prevent unauthenticated access, privileged users must utilize multifactor authentication to prevent potential misuse and compromise...
ESXI-06-000041 – The system must set a timeout to automatically disable idle sessions after a predetermined period.
Details If a user forgets to log out of their SSH session, the idle connection will remains open indefinitely, increasing...

DISA STIG VMware vSphere 6.x ESXi V1R5

ESXI-06-000001 – The VMM must limit the number of concurrent sessions to ten for all accounts and/or account types by enabling lockdown mode.

ESXI-06-000002 – The system must verify the DCUI.Access list.

ESXI-06-000003 – The system must verify the exception users list for lockdown mode.

ESXI-06-000004 – Remote logging for ESXi hosts must be configured.

ESXI-06-000005 – The system must enforce the limit of three consecutive invalid logon attempts by a user.

ESXI-06-000006 – The system must enforce the unlock timeout of 15 minutes after a user account is locked out.

ESXI-06-000007 – The system must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.

ESXI-06-000008 – The SSH daemon must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system.

ESXI-06-000040 – The system must use multifactor authentication for local access to privileged accounts.

ESXI-06-000041 – The system must set a timeout to automatically disable idle sessions after a predetermined period.