DISA STIG VMware vSphere ESXi 6 Security Technical Implementation Guide Version 1 Release 5

ESXI-06-000009 - The SSH daemon must be configured with the Department of Defense (DoD) login banner.

800-53|AC-8

CAT|II

CCI|CCI-000048

Group-ID|V-63187

Rule-ID|SV-77677r1_rule

STIG-ID|ESXI-06-000009

Vuln-ID|V-63187

ESXI-06-000010 - The VMM must use DoD-approved encryption to protect the confidentiality of remote access sessions.

800-53|SC-13

CCI|CCI-000068

Group-ID|V-63189

Rule-ID|SV-77679r3_rule

STIG-ID|ESXI-06-000010

Vuln-ID|V-63189

ESXI-06-000011 - The SSH daemon must be configured to use only the SSHv2 protocol.

800-53|AC-17(2)

CAT|I

Group-ID|V-63191

Rule-ID|SV-77681r1_rule

STIG-ID|ESXI-06-000011

Vuln-ID|V-63191

ESXI-06-000012 - The SSH daemon must ignore .rhosts files.

800-53|AC-14

800-53|IA-5

CCI|CCI-000767

Group-ID|V-63193

Rule-ID|SV-77683r1_rule

STIG-ID|ESXI-06-000012

Vuln-ID|V-63193

ESXI-06-000013 - The SSH daemon must not allow host-based authentication.

CCI|CCI-000366

Group-ID|V-63195

Rule-ID|SV-77685r1_rule

STIG-ID|ESXI-06-000013

Vuln-ID|V-63195

ESXI-06-000014 - The SSH daemon must not permit root logins.

800-53|AC-17

CAT|III

Group-ID|V-63197

Rule-ID|SV-77687r1_rule

STIG-ID|ESXI-06-000014

Vuln-ID|V-63197

ESXI-06-000015 - The SSH daemon must not allow authentication using an empty password.

Group-ID|V-63199

Rule-ID|SV-77689r1_rule

STIG-ID|ESXI-06-000015

Vuln-ID|V-63199

ESXI-06-000016 - The SSH daemon must not permit user environment settings.

800-53|CM-6

CSCv6|3.1

Group-ID|V-63201

Rule-ID|SV-77691r1_rule

STIG-ID|ESXI-06-000016

Vuln-ID|V-63201

ESXI-06-000017 - The SSH daemon must be configured to only use Message Authentication Codes (MACs) employing FIPS 140-2 approved cryptographic hash algorithms.

Group-ID|V-63203

Rule-ID|SV-77693r1_rule

STIG-ID|ESXI-06-000017

Vuln-ID|V-63203

ESXI-06-000018 - The SSH daemon must not permit GSSAPI authentication.

Group-ID|V-63205

Rule-ID|SV-77695r1_rule

STIG-ID|ESXI-06-000018

Vuln-ID|V-63205

ESXI-06-000019 - The SSH daemon must not permit Kerberos authentication.

Group-ID|V-63207

Rule-ID|SV-77697r1_rule

STIG-ID|ESXI-06-000019

Vuln-ID|V-63207

ESXI-06-000020 - The SSH daemon must perform strict mode checking of home directory configuration files.

Group-ID|V-63209

Rule-ID|SV-77699r1_rule

STIG-ID|ESXI-06-000020

Vuln-ID|V-63209

ESXI-06-000021 - The SSH daemon must not allow compression or must only allow compression after successful authentication.

Group-ID|V-63211

Rule-ID|SV-77701r1_rule

STIG-ID|ESXI-06-000021

Vuln-ID|V-63211

ESXI-06-000022 - The SSH daemon must be configured to not allow gateway ports.

Group-ID|V-63213

Rule-ID|SV-77703r1_rule

STIG-ID|ESXI-06-000022

Vuln-ID|V-63213

ESXI-06-000023 - The SSH daemon must be configured to not allow X11 forwarding.

Group-ID|V-63215

Rule-ID|SV-77705r1_rule

STIG-ID|ESXI-06-000023

Vuln-ID|V-63215

ESXI-06-000024 - The SSH daemon must not accept environment variables from the client.

Group-ID|V-63217

Rule-ID|SV-77707r1_rule

STIG-ID|ESXI-06-000024

Vuln-ID|V-63217

ESXI-06-000025 - The SSH daemon must not permit tunnels.

Group-ID|V-63219

Rule-ID|SV-77709r1_rule

STIG-ID|ESXI-06-000025

Vuln-ID|V-63219

ESXI-06-000026 - The SSH daemon must set a timeout count on idle sessions.

800-53|AC-12

CSCv6|16.4

Group-ID|V-63221

Rule-ID|SV-77711r1_rule

STIG-ID|ESXI-06-000026

Vuln-ID|V-63221

ESXI-06-000027 - The SSH daemon must set a timeout interval on idle sessions.

Group-ID|V-63223

Rule-ID|SV-77713r1_rule

STIG-ID|ESXI-06-000027

Vuln-ID|V-63223

ESXI-06-000028 - The SSH daemon must limit connections to a single session.

800-53|AC-10

Group-ID|V-63225

Rule-ID|SV-77715r1_rule

STIG-ID|ESXI-06-000028

Vuln-ID|V-63225

ESXI-06-000029 - The system must remove keys from the SSH authorized_keys file.

Group-ID|V-63227

Rule-ID|SV-77717r1_rule

STIG-ID|ESXI-06-000029

Vuln-ID|V-63227

ESXI-06-000032 - The system must prohibit the reuse of passwords within five iterations.

800-53|IA-5(1)

CCI|CCI-000200

Group-ID|V-63233

Rule-ID|SV-77723r1_rule

STIG-ID|ESXI-06-000032

Vuln-ID|V-63233

ESXI-06-000033 - The password hashes stored on the system must have been generated using a FIPS 140-2 approved cryptographic hashing algorithm.

Group-ID|V-63235

Rule-ID|SV-77725r1_rule

STIG-ID|ESXI-06-000033

Vuln-ID|V-63235

ESXI-06-000044 - The system must enable kernel core dumps.

800-53|SC-24

CCI|CCI-001665

Group-ID|V-63257

Rule-ID|SV-77747r1_rule

STIG-ID|ESXI-06-000044

Vuln-ID|V-63257

ESXI-06-000047 - The Image Profile and VIB Acceptance Levels must be verified.

800-53|CM-7(5)

CCI|CCI-001749

Group-ID|V-63263

Rule-ID|SV-77753r1_rule

STIG-ID|ESXI-06-000047

Vuln-ID|V-63263

ESXI-06-000056 - The system must configure the firewall to restrict access to services running on the host.

Group-ID|V-63281

Rule-ID|SV-77771r1_rule

STIG-ID|ESXI-06-000056

Vuln-ID|V-63281

ESXI-06-100010 - The SSH daemon must be configured to only use FIPS 140-2 approved ciphers.

CCI|CCI-002450

Group-ID|V-63501

Rule-ID|SV-77991r2_rule

STIG-ID|ESXI-06-100010

Vuln-ID|V-63501

ESXI-06-100047 - The VMM must employ a deny-all, permit-by-exception policy to allow the execution of authorized software programs and guest VMs by verifying Image Profile and VIP Acceptance Levels.

CCI|CCI-001774

Group-ID|V-63823

Rule-ID|SV-78313r1_rule

STIG-ID|ESXI-06-100047

Vuln-ID|V-63823

ESXI-06-200047 - The VMM must implement cryptographic mechanisms to prevent unauthorized modification of all information at rest on all VMM components by verifying Image Profile and VIP Acceptance Levels.

CCI|CCI-002475

Group-ID|V-63901

Rule-ID|SV-78391r1_rule

STIG-ID|ESXI-06-200047

Vuln-ID|V-63901

Detections

Analytics

DISA VMware vSphere ESXi 6.0 STIG v1r5 Unix

Audit Details

File Details

Audit Changelog

Revision 1.11

Miscellaneous

Revision 1.10

Miscellaneous

Revision 1.9

Miscellaneous

Revision 1.8

Miscellaneous

Revision 1.7

Miscellaneous

Revision 1.6

Miscellaneous

Revision 1.5

Miscellaneous

Revision 1.4

Miscellaneous

Revision 1.3

Miscellaneous

Revision 1.2

Miscellaneous


Revision 1.11 Feb 13, 2026 Miscellaneous Metadata updated. References updated. See also link updated.
Revision 1.10 Jun 17, 2024 Miscellaneous Metadata updated.
Revision 1.9 Dec 22, 2023 Miscellaneous Metadata updated. References updated.
Revision 1.8 Apr 12, 2023 Miscellaneous Metadata updated. Platform check updated.
Revision 1.7 Mar 7, 2023 Miscellaneous Metadata updated. References updated.
Revision 1.6 Apr 25, 2022 Miscellaneous Metadata updated. References updated.
Revision 1.5 Jul 30, 2021 Miscellaneous Metadata updated. References updated.
Revision 1.4 Jun 17, 2021 Miscellaneous Metadata updated.
Revision 1.3 May 5, 2021 Miscellaneous Metadata updated. References updated.
Revision 1.2 Sep 29, 2020 Miscellaneous References updated.

Detections

Analytics

DISA VMware vSphere ESXi 6.0 STIG v1r5 Unix Download File

Audit Details

File Details

Audit Changelog

Miscellaneous

Miscellaneous

Miscellaneous

Miscellaneous

Miscellaneous

Miscellaneous

Miscellaneous

Miscellaneous

Miscellaneous

Miscellaneous

DISA VMware vSphere ESXi 6.0 STIG v1r5 Unix