Detections
Analytics

3.21 (L2) Host should enable strict lockdown mode

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version

Information

Enabling lockdown mode disables direct local access to an ESXi host, requiring the host be managed remotely from vCenter Server.

There are some operations, such as backup and troubleshooting, that require direct access to the host. In these cases, lockdown mode can be disabled on a temporary basis for specific hosts as needed, and then re-enabled when the task is completed.

Note: Lockdown mode does not apply to users who log in using authorized keys. Also, users in the DCUI.Access list for each host are allowed to override lockdown mode and log in to the DCUI. By default, the "root" user is the only user listed in the DCUI.Access list.

Lockdown mode limits ESXi host access to the vCenter server to ensure the roles and access controls implemented in vCenter are always enforced and users cannot bypass them by logging into a host directly. By forcing all interaction to occur through vCenter Server, the risk of someone inadvertently attaining elevated privileges or performing tasks that are not properly audited is greatly reduced. Additionally strict lockdown move will disabled DCUI - Disabling DCUI prevents all local activity, and thus forces actions to be performed in vCenter Server, where they can be centrally audited and monitored.

Solution

To enable lockdown mode, perform the following from the vSphere web client:

 - From the vSphere Web Client, select the host.
 - Select Configure then expand System and select Security Profile.
 - Across from Lockdown Mode click on Edit.
 - Click the radio button for Strict.
 - Click OK.

Alternately, run the following PowerCLI command:

# Enable lockdown mode for each host
Get-VMHost | Foreach { $_.EnterLockdownMode() }

Impact:

With lockdown mode enabled the host will only be accessible through vCenter preventing 'local' access. Disabling the DCUI can create a potential "lockout" situation, should the host become isolated from vCenter Server. Recovering from a "lockout" scenario requires reinstalling ESXi. Consider leaving DCUI enabled, and instead enable lockdown mode and limit the users allowed to access the DCUI using the DCUI.Access list.

See Also

https://workbench.cisecurity.org/benchmarks/19200

Item Details

References: CSCv7|16.2

Plugin: VMware

Control ID: 2868f401df05bb7600dd6c84c0ee3a7ab77ed607dd9e9f8c9a2e19e77f076d5b