Detections
Analytics
3.7 (L1) Host must automatically terminate idle DCUI sessions
Warning! Audit Deprecated
This audit has been deprecated and will be removed in a future update.
View Next Audit VersionInformation
By configuring a session timeout, unattended console sessions are automatically terminated, thereby reducing the potential security risks associated with lingering active sessions. The parameter governing this behavior is UserVars.DcuiTimeOut, with a recommended setting of 600 (10 minutes).Automated termination of idle DCUI sessions enhances the security posture by minimizing the window of opportunity for unauthorized access through unattended sessions. It enforces a good security hygiene practice by ensuring that inactive sessions do not remain open indefinitely, which is in line with the principle of least privilege.
Solution
To correct the DCUI timeout setting, perform the following steps:- From the vSphere Web Client, select the host.
- Click Configure, then under System select Advanced System Settings.
- Select Edit then enter UserVars.DcuiTimeOut in the filter.
- Click in the box for the current value, then set the value to 600 seconds or less.
Alternately, use the following PowerCLI command:
Get-VMHost | Get-AdvancedSetting -Name UserVars.DcuiTimeOut | Set-AdvancedSetting -Value 600
Impact:
While there's no functional impact specified, setting a timeout value that's too short may inconvenience users by terminating sessions prematurely, possibly interrupting workflow. Conversely, a timeout value that's too long may not adequately mitigate the risks associated with idle sessions. Hence, a balanced approach in configuring the session timeout value, aligned with the organizational security policy and user workflow, is crucial.
See Also
Item Details
Audit Name: CIS VMware ESXi 8.0 v1.3.0 L1 VMware
Category: ACCESS CONTROL
References: 800-53|AC-2(5), 800-53|AC-11, 800-53|AC-11(1), 800-53|AC-12, CSCv7|16.11
Plugin: VMware
Control ID: f28df270260d97eb5f4ee720fa0857e7cb00482974a4790b38ee74564083372a