Home
Security Hardening
DISA STIG VMware vSphere ESXi 6.5 V2R3

DISA STIG VMware vSphere ESXi 6.5 V2R3

ESXI-65-000052 – The ESXi host must protect the confidentiality and integrity of transmitted information by utilizing different TCP/IP stacks where possible.
Details There are three different TCP/IP stacks by default available on ESXi now which are Default, Provisioning, and vMotion. To...
ESXI-65-000031 – The ESXi host must enforce password complexity by requiring that at least one upper-case character be used.
Details To enforce the use of complex passwords, minimum numbers of characters of different classes are mandated. The use of...
ESXI-65-000034 – The ESXi host must disable the Managed Object Browser (MOB).
Details The Managed Object Browser (MOB) provides a way to explore the object model used by the VMkernel to manage...
ESXI-65-000035 – The ESXi host must be configured to disable non-essential capabilities by disabling SSH.
Details The ESXi Shell is an interactive command line interface (CLI) available at the ESXi server console. The ESXi shell...
ESXI-65-000036 – The ESXi host must disable ESXi Shell unless needed for diagnostics or troubleshooting.
Details The ESXi Shell is an interactive command line environment available locally from the DCUI or remotely via SSH. Activities...
ESXI-65-000037 – The ESXi host must use Active Directory for local user authentication.
Details Join ESXi hosts to an Active Directory (AD) domain to eliminate the need to create and maintain multiple local...
ESXI-65-000058 – The ESXi host must enable BPDU filter on the host to prevent being locked out of physical switch ports with Portfast and BPDU Guard enabled.
Details BPDU Guard and Portfast are commonly enabled on the physical switch to which the ESXi host is directly connected...
ESXI-65-000059 – The virtual switch Forged Transmits policy must be set to reject on the ESXi host.
Details If the virtual machine operating system changes the MAC address, the operating system can send frames with an impersonated...
ESXI-65-000060 – The virtual switch MAC Address Change policy must be set to reject on the ESXi host.
Details If the virtual machine operating system changes the MAC address, it can send frames with an impersonated source MAC...
ESXI-65-000061 – The virtual switch Promiscuous Mode policy must be set to reject on the ESXi host.
Details When promiscuous mode is enabled for a virtual switch all virtual machines connected to the Portgroup have the potential...

Prev Next

DISA STIG VMware vSphere ESXi 6.5 V2R3

ESXI-65-000052 – The ESXi host must protect the confidentiality and integrity of transmitted information by utilizing different TCP/IP stacks where possible.

ESXI-65-000031 – The ESXi host must enforce password complexity by requiring that at least one upper-case character be used.

ESXI-65-000034 – The ESXi host must disable the Managed Object Browser (MOB).

ESXI-65-000035 – The ESXi host must be configured to disable non-essential capabilities by disabling SSH.

ESXI-65-000036 – The ESXi host must disable ESXi Shell unless needed for diagnostics or troubleshooting.

ESXI-65-000037 – The ESXi host must use Active Directory for local user authentication.

ESXI-65-000058 – The ESXi host must enable BPDU filter on the host to prevent being locked out of physical switch ports with Portfast and BPDU Guard enabled.

ESXI-65-000059 – The virtual switch Forged Transmits policy must be set to reject on the ESXi host.

ESXI-65-000060 – The virtual switch MAC Address Change policy must be set to reject on the ESXi host.

ESXI-65-000061 – The virtual switch Promiscuous Mode policy must be set to reject on the ESXi host.