Detections
Analytics

3.23 (L2) Host must deny shell access for the vpxuser account

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Deactivating shell access for the vpxuser account enhances security by enforcing an "API only" stance for predefined non-root ESXi users such as vpxuser and dcui.

This control reduces the attack surface by limiting the avenues through which system configurations can be altered, aligning with modern least privilege principles and ensuring that privileged authentication through vCenter Server remains tightly controlled.

NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.

Solution

Impact:

Deactivating shell access prevents users from granting shell access to others or changing passwords of users who have shell access, necessitating host-by-host reconfiguration through an authorized account if changes are required. This could potentially impact third-party workflows and necessitates the retention of at least one fully privileged user for necessary configurations.

See Also

https://workbench.cisecurity.org/benchmarks/19200

Item Details

References: CSCv7|2.7, CSCv7|2.8, CSCv7|2.9

Plugin: VMware

Control ID: 87a2732c65fa130f4c853a521ad42f3d02d3c8fa15df160706149e6f7792f7ac