DISA_STIG_VMware_vSphere_ESXi_6.5_Bare_Metal_Host_v2r4.audit from DISA VMware vSphere 6.5 ESXi v2r4 STIG

ESXI-65-000009 - The ESXi host SSH daemon must be configured with the Department of Defense (DoD) login banner.

800-53|AC-8a.

CAT|II

CCI|CCI-000048

Rule-ID|SV-207610r378520_rule

STIG-ID|ESXI-65-000009

STIG-Legacy|SV-104051

STIG-Legacy|V-93965

Vuln-ID|V-207610

ESXI-65-000010 - The ESXi host SSH daemon must use DoD-approved encryption to protect the confidentiality of remote access sessions.

800-53|AC-17(2)

CCI|CCI-000068

Rule-ID|SV-207611r766919_rule

STIG-ID|ESXI-65-000010

STIG-Legacy|SV-104053

STIG-Legacy|V-93967

Vuln-ID|V-207611

ESXI-65-000011 - The ESXi host SSH daemon must be configured to use only the SSHv2 protocol.

CAT|I

Rule-ID|SV-207612r378610_rule

STIG-ID|ESXI-65-000011

STIG-Legacy|SV-104055

STIG-Legacy|V-93969

Vuln-ID|V-207612

ESXI-65-000012 - The ESXi host SSH daemon must ignore .rhosts files.

800-53|IA-2(3)

CCI|CCI-000767

Rule-ID|SV-207613r378856_rule

STIG-ID|ESXI-65-000012

STIG-Legacy|SV-104057

STIG-Legacy|V-93971

Vuln-ID|V-207613

ESXI-65-000013 - The ESXi host SSH daemon must not allow host-based authentication.

800-53|CM-6b.

CCI|CCI-000366

Rule-ID|SV-207614r388482_rule

STIG-ID|ESXI-65-000013

STIG-Legacy|SV-104059

STIG-Legacy|V-93973

Vuln-ID|V-207614

ESXI-65-000014 - The ESXi host SSH daemon must not permit root logins.

CAT|III

Rule-ID|SV-207615r388482_rule

STIG-ID|ESXI-65-000014

STIG-Legacy|SV-104061

STIG-Legacy|V-93975

Vuln-ID|V-207615

ESXI-65-000015 - The ESXi host SSH daemon must not allow authentication using an empty password.

Rule-ID|SV-207616r388482_rule

STIG-ID|ESXI-65-000015

STIG-Legacy|SV-104063

STIG-Legacy|V-93977

Vuln-ID|V-207616

ESXI-65-000016 - The ESXi host SSH daemon must not permit user environment settings.

Rule-ID|SV-207617r388482_rule

STIG-ID|ESXI-65-000016

STIG-Legacy|SV-104065

STIG-Legacy|V-93979

Vuln-ID|V-207617

ESXI-65-000017 - The ESXi host SSH daemon must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.

Rule-ID|SV-207618r388482_rule

STIG-ID|ESXI-65-000017

STIG-Legacy|SV-104067

STIG-Legacy|V-93981

Vuln-ID|V-207618

ESXI-65-000018 - The ESXi host SSH daemon must not permit GSSAPI authentication.

Rule-ID|SV-207619r388482_rule

STIG-ID|ESXI-65-000018

STIG-Legacy|SV-104069

STIG-Legacy|V-93983

Vuln-ID|V-207619

ESXI-65-000019 - The ESXi host SSH daemon must not permit Kerberos authentication.

Rule-ID|SV-207620r388482_rule

STIG-ID|ESXI-65-000019

STIG-Legacy|SV-104071

STIG-Legacy|V-93985

Vuln-ID|V-207620

ESXI-65-000020 - The ESXi host SSH daemon must perform strict mode checking of home directory configuration files.

Rule-ID|SV-207621r388482_rule

STIG-ID|ESXI-65-000020

STIG-Legacy|SV-104073

STIG-Legacy|V-93987

Vuln-ID|V-207621

ESXI-65-000021 - The ESXi host SSH daemon must not allow compression or must only allow compression after successful authentication.

Rule-ID|SV-207622r388482_rule

STIG-ID|ESXI-65-000021

STIG-Legacy|SV-104075

STIG-Legacy|V-93989

Vuln-ID|V-207622

ESXI-65-000022 - The ESXi host SSH daemon must be configured to not allow gateway ports.

Rule-ID|SV-207623r388482_rule

STIG-ID|ESXI-65-000022

STIG-Legacy|SV-104077

STIG-Legacy|V-93991

Vuln-ID|V-207623

ESXI-65-000023 - The ESXi host SSH daemon must be configured to not allow X11 forwarding.

Rule-ID|SV-207624r388482_rule

STIG-ID|ESXI-65-000023

STIG-Legacy|SV-104079

STIG-Legacy|V-93993

Vuln-ID|V-207624

ESXI-65-000024 - The ESXi host SSH daemon must not accept environment variables from the client.

Rule-ID|SV-207625r388482_rule

STIG-ID|ESXI-65-000024

STIG-Legacy|SV-104081

STIG-Legacy|V-93995

Vuln-ID|V-207625

ESXI-65-000025 - The ESXi host SSH daemon must not permit tunnels.

Rule-ID|SV-207626r388482_rule

STIG-ID|ESXI-65-000025

STIG-Legacy|SV-104083

STIG-Legacy|V-93997

Vuln-ID|V-207626

ESXI-65-000026 - The ESXi host SSH daemon must set a timeout count on idle sessions.

Rule-ID|SV-207627r388482_rule

STIG-ID|ESXI-65-000026

STIG-Legacy|SV-104085

STIG-Legacy|V-93999

Vuln-ID|V-207627

ESXI-65-000027 - The ESXi hostSSH daemon must set a timeout interval on idle sessions.

Rule-ID|SV-207628r388482_rule

STIG-ID|ESXI-65-000027

STIG-Legacy|SV-104087

STIG-Legacy|V-94001

Vuln-ID|V-207628

ESXI-65-000028 - The ESXi host SSH daemon must limit connections to a single session.

Rule-ID|SV-207629r388482_rule

STIG-ID|ESXI-65-000028

STIG-Legacy|SV-104089

STIG-Legacy|V-94003

Vuln-ID|V-207629

ESXI-65-000029 - The ESXi host must remove keys from the SSH authorized_keys file.

Rule-ID|SV-207630r388482_rule

STIG-ID|ESXI-65-000029

STIG-Legacy|SV-104091

STIG-Legacy|V-94005

Vuln-ID|V-207630

ESXI-65-000032 - The ESXi host must prohibit the reuse of passwords within five iterations.

800-53|IA-5(1)(e)

CCI|CCI-000200

Rule-ID|SV-207633r378763_rule

STIG-ID|ESXI-65-000032

STIG-Legacy|SV-104097

STIG-Legacy|V-94011

Vuln-ID|V-207633

ESXI-65-000033 - The password hashes stored on the ESXi host must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm.

Rule-ID|SV-207634r388482_rule

STIG-ID|ESXI-65-000033

STIG-Legacy|SV-104099

STIG-Legacy|V-94013

Vuln-ID|V-207634

ESXI-65-000044 - The ESXi host must enable kernel core dumps.

800-53|SC-24

CCI|CCI-001665

Rule-ID|SV-207645r379318_rule

STIG-ID|ESXI-65-000044

STIG-Legacy|SV-104121

STIG-Legacy|V-94035

Vuln-ID|V-207645

ESXI-65-000047 - The ESXi Image Profile and VIB Acceptance Levels must be verified.

800-53|CM-5(3)

CCI|CCI-001749

Rule-ID|SV-207648r878138_rule

STIG-ID|ESXI-65-000047

STIG-Legacy|SV-104127

STIG-Legacy|V-94041

Vuln-ID|V-207648

ESXI-65-000056 - The ESXi host must configure the firewall to restrict access to services running on the host.

Rule-ID|SV-207655r388482_rule

STIG-ID|ESXI-65-000056

STIG-Legacy|SV-104145

STIG-Legacy|V-94059

Vuln-ID|V-207655

ESXI-65-000076 - The ESXi host must enable Secure Boot.

Rule-ID|SV-207673r388482_rule

STIG-ID|ESXI-65-000076

STIG-Legacy|SV-104317

STIG-Legacy|V-94487

Vuln-ID|V-207673

ESXI-65-000078 - The ESXi host must use DoD-approved certificates.

Rule-ID|SV-207674r617349_rule

STIG-ID|ESXI-65-000078

STIG-Legacy|SV-104319

STIG-Legacy|V-94489

Vuln-ID|V-207674

Detections

Analytics

Revision 1.1

Jun 17, 2024

Miscellaneous