The ESXi host must disable ESXi Shell unless needed for diagnostics or troubleshooting.
Overview
| Finding ID | Version | Rule ID | IA Controls | Severity |
|---|---|---|---|---|
| V-239291 | ESXI-67-000036 | SV-239291r674802_rule | Medium |
| Description |
|---|
| The ESXi Shell is an interactive command line environment available locally from the DCUI or remotely via SSH. Activities performed from the ESXi Shell bypass vCenter RBAC and audit controls. The ESXi shell should only be turned on when needed to troubleshoot/resolve problems that cannot be fixed through the vSphere client. |
| STIG | Date |
|---|---|
| VMware vSphere 6.7 ESXi Security Technical Implementation Guide | 2022-01-05 |
Details
| Check Text ( C-42524r674800_chk ) |
|---|
| From the vSphere Client, select the ESXi host and go to Configure >> System >> Services. Under "Services", select "Edit", view the "ESXi Shell" service, and verify it is stopped. or From a PowerCLI command prompt while connected to the ESXi host, run the following command: Get-VMHost | Get-VMHostService | Where {$_.Label -eq "ESXi Shell"} If the ESXi Shell service is running, this is a finding. |
| Fix Text (F-42483r674801_fix) |
|---|
| From the vSphere Client, select the ESXi host and go to Configure >> System >> Services. Under "Services", select "ESXi Shell" service and click the "Stop" button to stop the service. Use Edit Startup policy to "Start and stop manually" and click "OK". or From a PowerCLI command prompt while connected to the ESXi host, run the following commands: Get-VMHost | Get-VMHostService | Where {$_.Label -eq "ESXi Shell"} | Set-VMHostService -Policy Off Get-VMHost | Get-VMHostService | Where {$_.Label -eq "ESXi Shell"} | Stop-VMHostService |