5.9 Ensure the shell services timeout is set to 1 hour or less

Information

When the ESXi shell or SSH services are enabled on a host, they will run indefinitely. To avoid this, set the ESXiShellTimeOut, which defines a window of time after which the ESXi shell and SSH services will automatically be terminated.

It is recommended to set the ESXiShellInteractiveTimeOut together with ESXiShellTimeOut.

Rationale:

This reduces the risk of an inactive ESXi shell or SSH service being misused by an unauthorized party to compromise a host.

Solution

To set the timeout to the desired value, perform the following from the vSphere web client:

Select the host and click 'Configure' -> 'System' -> 'Advanced System Settings'.

Type ESXiShellTimeOut in the filter.

Click on the attribute to highlight it.

Click the pencil icon to edit.

Set the attribute to 3600 seconds (1 hour) or less.

Click 'OK'.

Note: A value of 0 disables the ESXiShellTimeOut.
Alternately, run the following PowerCLI command:

# Set UserVars.ESXiShellTimeOut to 3600 on all hosts
Get-VMHost | Get-AdvancedSetting -Name 'UserVars.ESXiShellTimeOut' | Set-AdvancedSetting -Value '3600'

See Also

https://workbench.cisecurity.org/benchmarks/8020