Detections
Analytics

3.22 Host must deny shell access for the dcui account

Information

The dcui account, utilized for process isolation for the Direct Console User Interface (DCUI), possesses shell access which, when deactivated, minimizes the attack surface. This action is a proactive measure to enhance system security.

Deactivating shell access for the dcui account reduces the avenues of exploitation available to potential attackers. It is a prudent step towards a hardened security posture.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Configure the dcui service account to have no shell access using the supported ESXi account-management mechanism for the installed build, and verify that the account cannot establish an interactive shell.

Note: It is advised not to manually edit /etc/passwd unless directed by Broadcom support.

Impact:

There is no functional impact noted from denying shell access for the dcui account, making it a low-risk yet effective security control.

See Also

https://workbench.cisecurity.org/benchmarks/26357

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|CM-7, 800-53|CM-7(1), 800-53|CM-7(5), 800-53|CM-10, 800-53|SI-7, 800-53|SI-7(1), CSCv7|2.7, CSCv7|2.8, CSCv7|2.9

Plugin: Unix

Control ID: 7566e969d48d1a1012cac4f2ea0e5bb7064b582ca66997529077a90a6f41d20d