Home
Security Hardening
DISA STIG VMware vSphere ESXi 6.5 V2R3

DISA STIG VMware vSphere ESXi 6.5 V2R3

ESXI-65-000038 – The ESXi host must use the vSphere Authentication Proxy to protect passwords when adding ESXi hosts to Active Directory.
Details If you configure your host to join an Active Directory domain using Host Profiles the Active Directory credentials are...
ESXI-65-000039 – Active Directory ESX Admin group membership must not be used when adding ESXi hosts to Active Directory.
Details When adding ESXi hosts to Active Directory, if the group ‘ESX Admins’ exists, all user/group accounts assigned to the...
ESXI-65-000040 – The ESXi host must use multifactor authentication for local access to privileged accounts.
Details To assure accountability and prevent unauthenticated access, privileged users must utilize multifactor authentication to prevent potential misuse and compromise...
ESXI-65-000041 – The ESXi host must set a timeout to automatically disable idle sessions after 10 minutes.
Details If a user forgets to log out of their SSH session, the idle connection will remains open indefinitely, increasing...
ESXI-65-000042 – The ESXi host must terminate shell services after 10 minutes.
Details When the ESXi Shell or SSH services are enabled on a host they will run indefinitely. To avoid having...
ESXI-65-000045 – The ESXi host must enable a persistent log location for all locally stored logs.
Details ESXi can be configured to store log files on an in-memory file system. This occurs when the host’s ‘/scratch’...
ESXI-65-000046 – The ESXi host must configure NTP time synchronization.
Details To assure the accuracy of the system clock, it must be synchronized with an authoritative time source within DoD....
ESXI-65-000048 – The ESXi host must protect the confidentiality and integrity of transmitted information by isolating vMotion traffic.
Details While encrypted vMotion is available now vMotion traffic should still be sequestered from other traffic to further protect it...
ESXI-65-000049 – The ESXi host must protect the confidentiality and integrity of transmitted information.
Details From the vSphere Web Client select the ESXi Host and go to Configure >> Networking >> VMkernel adapters. Review...
ESXI-65-000050 – The ESXi host must protect the confidentiality and integrity of transmitted information by protecting IP based management traffic.
Details Virtual machines might share virtual switches and VLANs with the IP-based storage configurations. IP-based storage includes vSAN, iSCSI and...

Prev Next

DISA STIG VMware vSphere ESXi 6.5 V2R3

ESXI-65-000038 – The ESXi host must use the vSphere Authentication Proxy to protect passwords when adding ESXi hosts to Active Directory.

ESXI-65-000039 – Active Directory ESX Admin group membership must not be used when adding ESXi hosts to Active Directory.

ESXI-65-000040 – The ESXi host must use multifactor authentication for local access to privileged accounts.

ESXI-65-000041 – The ESXi host must set a timeout to automatically disable idle sessions after 10 minutes.

ESXI-65-000042 – The ESXi host must terminate shell services after 10 minutes.

ESXI-65-000045 – The ESXi host must enable a persistent log location for all locally stored logs.

ESXI-65-000046 – The ESXi host must configure NTP time synchronization.

ESXI-65-000048 – The ESXi host must protect the confidentiality and integrity of transmitted information by isolating vMotion traffic.

ESXI-65-000049 – The ESXi host must protect the confidentiality and integrity of transmitted information.

ESXI-65-000050 – The ESXi host must protect the confidentiality and integrity of transmitted information by protecting IP based management traffic.