8.1.3 Limit sharing of console connections

Information

Limit the max number of console connections to prevent non-administrators from
observing the VMs screen.

*Rationale*

By default, remote console sessions can be connected to by more than one user at a time.
When multiple sessions are activated, each terminal window gets a notification about the
new session. If an administrator in the VM logs in using a VMware remote console during
their session, a non-administrator in the VM might connect to the console and observe the
administrator's actions. Also, this could result in an administrator losing console access to a
virtual machine. For example if a jump box is being used for an open console session, and
the admin loses connection to that box, then the console session remains open. Allowing
two console sessions permits debugging via a shared session. For highest security, only one
remote console session at a time should be allowed.

Solution

To implement the recommended configuration state, run the following PowerCLI
command-# Add the setting to all VMs
Get-VM | New-AdvancedSetting -Name 'RemoteDisplay.maxConnections' -value 1

Impact-Only one remote console connection to the VM will be permitted. Other attempts will be
rejected until the first session disconnects.

Default Value-The prescribed state is not the default state.

See Also

https://workbench.cisecurity.org/files/902

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-6

Plugin: VMware

Control ID: baae04d84664fa9e83623398033cb0b3c75d73807e8a9b9db157d5eaaaf6e330