Information
To ensure accountability and prevent unauthenticated access, privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system.
Note: This feature requires an existing PKI and AD integration.
Satisfies: SRG-OS-000107-VMM-000530, SRG-OS-000376-VMM-001520, SRG-OS-000377-VMM-001530, SRG-OS-000403-VMM-001640
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
The following are prerequisites to configuration of smart card authentication for the ESXi DCUI:
- Active Directory domain that supports smart card authentication, smart card readers, and smart cards;
- ESXi joined to an Active Directory domain; and
- Trusted certificates for root and intermediary certificate authorities.
From the vSphere Client, select the ESXi host and go to Configure >> System >> Authentication Services, click 'Edit', and check the 'Enable Smart Card Authentication' checkbox.
At the 'Certificates' tab, click the green plus sign to import trusted certificate authority certificates and click 'OK'.