Home
Security Hardening
DISA STIG VMware vSphere ESXi OS 6.5 V2R3

DISA STIG VMware vSphere ESXi OS 6.5 V2R3

ESXI-65-000021 – The ESXi host SSH daemon must not allow compression or must only allow compression after successful authentication.
Details If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in...
ESXI-65-000022 – The ESXi host SSH daemon must be configured to not allow gateway ports.
Details SSH TCP connection forwarding provides a mechanism to establish TCP connections proxied by the SSH server. This function can...
ESXI-65-000032 – The ESXi host must prohibit the reuse of passwords within five iterations.
Details If a user, or root, used the same password continuously or was allowed to change it back shortly after...
ESXI-65-000033 – The password hashes stored on the ESXi host must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm.
Details Systems must employ cryptographic hashes for passwords using the SHA-2 family of algorithms or FIPS 140-2 approved successors. The...
ESXI-65-000044 – The ESXi host must enable kernel core dumps.
Details In the event of a system failure, the system must preserve any information necessary to determine cause of failure...
ESXI-65-000047 – The ESXi Image Profile and VIB Acceptance Levels must be verified.
Details Verify the ESXi Image Profile to only allow signed VIBs. An unsigned VIB represents untested code installed on an...
ESXI-65-000056 – The ESXi host must configure the firewall to restrict access to services running on the host.
Details Unrestricted access to services running on an ESXi host can expose a host to outside attacks and unauthorized access....
ESXI-65-000076 – The ESXi host must enable Secure Boot.
Details Secure Boot is a protocol of UEFI firmware that ensures the integrity of the boot process from hardware up...
ESXI-65-000078 – The ESXi host must use DoD-approved certificates.
Details The default self-signed, VMCA issued host certificate must be replaced with a DoD-approved certificate. The use of a DoD...

DISA STIG VMware vSphere ESXi OS 6.5 V2R3

ESXI-65-000021 – The ESXi host SSH daemon must not allow compression or must only allow compression after successful authentication.

ESXI-65-000022 – The ESXi host SSH daemon must be configured to not allow gateway ports.

ESXI-65-000032 – The ESXi host must prohibit the reuse of passwords within five iterations.

ESXI-65-000033 – The password hashes stored on the ESXi host must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm.

ESXI-65-000044 – The ESXi host must enable kernel core dumps.

ESXI-65-000047 – The ESXi Image Profile and VIB Acceptance Levels must be verified.

ESXI-65-000056 – The ESXi host must configure the firewall to restrict access to services running on the host.

ESXI-65-000076 – The ESXi host must enable Secure Boot.

ESXI-65-000078 – The ESXi host must use DoD-approved certificates.