Information
The VM console enables you to connect to the console of a VM, in effect seeing what a monitor on a physical server would show. The VM console also provides power management and removable device connectivity controls. Instead of the VM console, use native remote management services, such as terminal services and ssh, to interact with VMs. Grant access to the VM console only when needed, and use custom roles to provide fine-grained permissions for those people who do need access. By default, the vCenter roles 'Virtual Machine Power User' and 'Virtual Machine Administrator' have the 'Virtual Machine.Interaction.Console Interaction' privilege.
Rationale:
The VM console could be misused to eavesdrop on VM activity, cause VM outages, and negatively affect the performance of the console, especially if many VM console sessions are open simultaneously.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
To properly limit use of the VM console, perform the following steps:
From the vSphere Client, navigate to vCenter --> Administration --> Roles.
Create a custom role and choose Edit to enable only the minimum needed effective privileges.
Next, select an object in the inventory.
Click the Permissions tab to view the user and role pair assignments for that object.
Remove any default 'Admin' or 'Power User' roles, and assign the new custom role as needed.
References:
https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.security.doc/GUID-41E5E52E-A95B-4E81-9724-6AD6800BEF78.html
https://docs.vmware.com/en/VMware-vSphere/6.7/com.vmware.vsphere.security.doc/GUID-3D47149A-947D-4608-88B3-E5811129EFA8.html
Notes:
You can set this privilege at different levels in the hierarchy. For example, if you set a privilege at the folder level, you can propagate the privilege to one or more objects within the folder. The object listed in the Required On column must have the privilege set, either directly or inherited.