5.2 Disable ESXi Shell unless needed for diagnostics or troubleshooting

Information

The ESXi shell should only be enabled when running diagnostics or troubleshooting.
Otherwise, it should be disabled on each host.

*Rationale*

ESXi Shell is an interactive command line environment available from the Direct Console
User Interface (DCUI) or remotely via SSH. Access to this mode requires the root password
of the server. The ESXi Shell can be turned on and off for individual hosts. Activities
performed from the ESXi Shell bypass vCenter RBAC and audit controls. The ESXi shell
should only be turned on when needed to troubleshoot/resolve problems that cannot be
fixed through the vSphere web client or vCLI/PowerCLI. You can use the vSphere Web
Client to enable local and remote (SSH) access to the ESXi Shell and to set the idle timeout
and availability timeout.

Solution

Perform the following-

1. From the vSphere web client select the host.
2. Select 'Manage' -> 'Settings' -> 'System' -> 'Security Profile'.
3. Scroll down to 'Services'.
4. Click 'Edit...'.
5. Select 'ESXi Shell'.
6. Click 'Stop'.
7. Change the Startup Policy 'Start and Stop Manually'
8. Click 'OK'.Additionally, the following PowerCLI command will implement the recommended
configuration state-# Set ESXi Shell to start manually rather than automatic for all hosts
Get-VMHost | Get-VMHostService | Where { $_.key -eq 'TSM' } | Set-VMHostService -
Policy Off

Default Value-The prescribed state is the default state.

See Also

https://workbench.cisecurity.org/files/145

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7

Plugin: VMware

Control ID: b421d8275fdf706e126c299e96b46f640317e0564634e31b58a229fd4a24cced