ESXI-06-000036 - The system must disable ESXi Shell unless needed for diagnostics or troubleshooting.

Information

The ESXi Shell is an interactive command line environment available locally from the DCUI or remotely via SSH. Activities performed from the ESXi Shell bypass vCenter RBAC and audit controls. The ESXi shell should only be turned on when needed to troubleshoot/resolve problems that cannot be fixed through the vSphere client.

Solution

From the vSphere Client select the ESXi Host and go to Configuration >> Security Profile. Under Services select Edit then select the ESXi Shell service and click options. Change the service to 'Start and stop manually' and stop the service and click OK.

or

From a PowerCLI command prompt while connected to the ESXi host run the following commands:

Get-VMHost | Get-VMHostService | Where {$_.Label -eq 'ESXi Shell'} | Set-VMHostService -Policy Off
Get-VMHost | Get-VMHostService | Where {$_.Label -eq 'ESXi Shell'} | Stop-VMHostService

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMware_vSphere_6-0_ESXi_V1R5_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7a., CAT|II, CCI|CCI-000381, Group-ID|V-63241, Rule-ID|SV-77731r1_rule, STIG-ID|ESXI-06-000036, Vuln-ID|V-63241

Plugin: VMware

Control ID: d50c23b70fee2cd745e9fecf8558902c3711db1695c036a8b6323a9e35f8b5eb