ESXI-67-000001 - Access to the ESXi host must be limited by enabling Lockdown Mode.

CAT|II

CCI|CCI-000054

CCI|CCI-001682

Rule-ID|SV-239258r674703_rule

STIG-ID|ESXI-67-000001

Vuln-ID|V-239258

ESXI-67-000002 - The ESXi host must verify the DCUI.Access list.

CAT|III

CCI|CCI-000366

Rule-ID|SV-239259r674706_rule

STIG-ID|ESXI-67-000002

Vuln-ID|V-239259

ESXI-67-000003 - The ESXi host must verify the exception users list for Lockdown Mode.

Rule-ID|SV-239260r674709_rule

STIG-ID|ESXI-67-000003

Vuln-ID|V-239260

ESXI-67-000004 - Remote logging for ESXi hosts must be configured.

CCI|CCI-000067

CCI|CCI-001851

Rule-ID|SV-239261r674712_rule

STIG-ID|ESXI-67-000004

Vuln-ID|V-239261

ESXI-67-000005 - The ESXi host must enforce the limit of three consecutive invalid logon attempts by a user.

CCI|CCI-000044

Rule-ID|SV-239262r674715_rule

STIG-ID|ESXI-67-000005

Vuln-ID|V-239262

ESXI-67-000006 - The ESXi host must enforce the unlock timeout of 15 minutes after a user account is locked out.

CCI|CCI-002238

Rule-ID|SV-239263r674718_rule

STIG-ID|ESXI-67-000006

Vuln-ID|V-239263

ESXI-67-000007 - The ESXi host must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system via the DCUI.

CCI|CCI-000048

CCI|CCI-000050

Rule-ID|SV-239264r674721_rule

STIG-ID|ESXI-67-000007

Vuln-ID|V-239264

ESXI-67-000008 - The ESXi host must display the Standard Mandatory DoD Notice and Consent Banner before granting access to the system via SSH.

Rule-ID|SV-239265r674724_rule

STIG-ID|ESXI-67-000008

Vuln-ID|V-239265

ESXI-67-000030 - The ESXi host must produce audit records containing information to establish what type of events occurred.

CCI|CCI-000130

CCI|CCI-000171

Rule-ID|SV-239285r674784_rule

STIG-ID|ESXI-67-000030

Vuln-ID|V-239285

ESXI-67-000031 - The ESXi host must enforce password complexity by requiring that at least one uppercase character be used.

CCI|CCI-000192

CCI|CCI-000193

CCI|CCI-000194

CCI|CCI-000195

CCI|CCI-000205

CCI|CCI-001619

Rule-ID|SV-239286r674787_rule

STIG-ID|ESXI-67-000031

Vuln-ID|V-239286

ESXI-67-000032 - The ESXi host must prohibit the reuse of passwords within five iterations.

CCI|CCI-000200

Rule-ID|SV-239287r674790_rule

STIG-ID|ESXI-67-000032

Vuln-ID|V-239287

ESXI-67-000034 - The ESXi host must disable the Managed Object Browser (MOB).

CCI|CCI-000381

Rule-ID|SV-239289r674796_rule

STIG-ID|ESXI-67-000034

Vuln-ID|V-239289

ESXI-67-000035 - The ESXi host must be configured to disable nonessential capabilities by disabling SSH.

CCI|CCI-002314

CCI|CCI-002322

Rule-ID|SV-239290r674799_rule

STIG-ID|ESXI-67-000035

Vuln-ID|V-239290

ESXI-67-000036 - The ESXi host must disable ESXi Shell unless needed for diagnostics or troubleshooting.

Rule-ID|SV-239291r674802_rule

STIG-ID|ESXI-67-000036

Vuln-ID|V-239291

ESXI-67-000037 - The ESXi host must use Active Directory for local user authentication.

CCI|CCI-000764

CCI|CCI-000770

CCI|CCI-001941

CCI|CCI-001942

Rule-ID|SV-239292r674805_rule

STIG-ID|ESXI-67-000037

Vuln-ID|V-239292

ESXI-67-000038 - ESXi hosts using Host Profiles and/or Auto Deploy must use the vSphere Authentication Proxy to protect passwords when adding themselves to Active Directory.

Rule-ID|SV-239293r816572_rule

STIG-ID|ESXI-67-000038

Vuln-ID|V-239293

ESXI-67-000039 - Active Directory ESX Admin group membership must not be used when adding ESXi hosts to Active Directory.

Rule-ID|SV-239294r674811_rule

STIG-ID|ESXI-67-000039

Vuln-ID|V-239294

ESXI-67-000040 - The ESXi host must use multifactor authentication for local DCUI access to privileged accounts.

CCI|CCI-000767

CCI|CCI-001953

CCI|CCI-001954

CCI|CCI-002470

Rule-ID|SV-239295r816574_rule

STIG-ID|ESXI-67-000040

Vuln-ID|V-239295

ESXI-67-000041 - The ESXi host must set a timeout to automatically disable idle shell sessions after two minutes.

CCI|CCI-001133

CCI|CCI-002361

Rule-ID|SV-239296r674817_rule

STIG-ID|ESXI-67-000041

Vuln-ID|V-239296

ESXI-67-000042 - The ESXi host must terminate shell services after 10 minutes.

Rule-ID|SV-239297r674820_rule

STIG-ID|ESXI-67-000042

Vuln-ID|V-239297

ESXI-67-000043 - The ESXi host must log out of the console UI after two minutes.

Rule-ID|SV-239298r674823_rule

STIG-ID|ESXI-67-000043

Vuln-ID|V-239298

ESXI-67-000045 - The ESXi host must enable a persistent log location for all locally stored logs.

CCI|CCI-001849

Rule-ID|SV-239300r674829_rule

STIG-ID|ESXI-67-000045

Vuln-ID|V-239300

ESXI-67-000046 - The ESXi host must configure NTP time synchronization.

CCI|CCI-001891

CCI|CCI-002046

Rule-ID|SV-239301r674832_rule

STIG-ID|ESXI-67-000046

Vuln-ID|V-239301

ESXI-67-000048 - The ESXi host must protect the confidentiality and integrity of transmitted information by isolating vMotion traffic.

CCI|CCI-002418

Rule-ID|SV-239303r674838_rule

STIG-ID|ESXI-67-000048

Vuln-ID|V-239303

ESXI-67-000049 - The ESXi host must protect the confidentiality and integrity of transmitted information by protecting ESXi management traffic.

Rule-ID|SV-239304r674841_rule

STIG-ID|ESXI-67-000049

Vuln-ID|V-239304

ESXI-67-000050 - The ESXi host must protect the confidentiality and integrity of transmitted information by isolating IP-based storage traffic.

Rule-ID|SV-239305r674844_rule

STIG-ID|ESXI-67-000050

Vuln-ID|V-239305

ESXI-67-000052 - The ESXi host must protect the confidentiality and integrity of transmitted information by using different TCP/IP stacks where possible.

Rule-ID|SV-239306r674847_rule

STIG-ID|ESXI-67-000052

Vuln-ID|V-239306

ESXI-67-000053 - SNMP must be configured properly on the ESXi host.

Rule-ID|SV-239307r674850_rule

STIG-ID|ESXI-67-000053

Vuln-ID|V-239307

ESXI-67-000054 - The ESXi host must enable bidirectional CHAP authentication for iSCSI traffic.

Rule-ID|SV-239308r674853_rule

STIG-ID|ESXI-67-000054

Vuln-ID|V-239308

ESXI-67-000055 - The ESXi host must disable Inter-VM transparent page sharing.

Rule-ID|SV-239309r674856_rule

STIG-ID|ESXI-67-000055

Vuln-ID|V-239309

ESXI-67-000057 - The ESXi host must configure the firewall to block network traffic by default - incoming

Rule-ID|SV-239311r674862_rule

STIG-ID|ESXI-67-000057

Vuln-ID|V-239311

ESXI-67-000057 - The ESXi host must configure the firewall to block network traffic by default - outgoing

ESXI-67-000058 - The ESXi host must enable BPDU filter on the host to prevent being locked out of physical switch ports with Portfast and BPDU Guard enabled.

Rule-ID|SV-239312r674865_rule

STIG-ID|ESXI-67-000058

Vuln-ID|V-239312

ESXI-67-000059 - The virtual switch Forged Transmits policy must be set to reject on the ESXi host.

Rule-ID|SV-239313r674868_rule

STIG-ID|ESXI-67-000059

Vuln-ID|V-239313

ESXI-67-000060 - The virtual switch MAC Address Change policy must be set to reject on the ESXi host.

CAT|I

Rule-ID|SV-239314r674871_rule

STIG-ID|ESXI-67-000060

Vuln-ID|V-239314

ESXI-67-000061 - The virtual switch Promiscuous Mode policy must be set to reject on the ESXi host.

Rule-ID|SV-239315r674874_rule

STIG-ID|ESXI-67-000061

Vuln-ID|V-239315

ESXI-67-000062 - The ESXi host must prevent unintended use of the dvFilter network APIs.

Rule-ID|SV-239316r674877_rule

STIG-ID|ESXI-67-000062

Vuln-ID|V-239316

ESXI-67-000063 - For the ESXi host, all port groups must be configured to a value other than that of the native VLAN.

Rule-ID|SV-239317r674880_rule

STIG-ID|ESXI-67-000063

Vuln-ID|V-239317

ESXI-67-000064 - For the ESXi host, all port groups must not be configured to VLAN 4095 unless Virtual Guest Tagging (VGT) is required - VGT is required.

Rule-ID|SV-239318r674883_rule

STIG-ID|ESXI-67-000064

Vuln-ID|V-239318

ESXI-67-000065 - For the ESXi host, all port groups must not be configured to VLAN values reserved by upstream physical switches.

Rule-ID|SV-239319r674886_rule

STIG-ID|ESXI-67-000065

Vuln-ID|V-239319

ESXI-67-000066 - For physical switch ports connected to the ESXi host, the non-negotiate option must be configured for trunk links between external physical switches and virtual switches in Virtual Switch Tagging (VST) mode.

Rule-ID|SV-239320r674889_rule

STIG-ID|ESXI-67-000066

Vuln-ID|V-239320

ESXI-67-000067 - All ESXi host-connected physical switch ports must be configured with spanning tree disabled.

Detections

Analytics

DISA STIG VMware vSphere 6.7 ESXi v1r2

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.6

Miscellaneous

Revision 1.5

Miscellaneous

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

Revision 1.0

Miscellaneous


Revision 1.6 Oct 31, 2023 Miscellaneous Audit deprecated. Metadata updated. References updated.
Revision 1.5 Jul 24, 2023 Miscellaneous Variables updated.
Revision 1.4 May 24, 2023 Miscellaneous Variables updated.
Revision 1.3 Mar 7, 2023 Miscellaneous Metadata updated. References updated.
Revision 1.2 Feb 27, 2023 Miscellaneous Metadata updated. See also link updated. Variables updated.
Revision 1.1 Dec 7, 2022 Miscellaneous Metadata updated.
Revision 1.0 Jun 10, 2022 Miscellaneous Metadata updated.

Detections

Analytics

DISA STIG VMware vSphere 6.7 ESXi v1r2 Download File

Warning! Audit Deprecated

Audit Details

File Details

Audit Changelog

Revision 1.6

Miscellaneous

Revision 1.5

Miscellaneous

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous

Revision 1.1

Miscellaneous

Revision 1.0

Miscellaneous

DISA STIG VMware vSphere 6.7 ESXi v1r2