Detections
Analytics

3.23 Host must deny shell access for the vpxuser account

Information

Deactivating shell access for the vpxuser account enhances security by enforcing an "API only" stance for predefined non-root ESXi users such as vpxuser and dcui.

This control reduces the attack surface by limiting the avenues through which system configurations can be altered, aligning with modern least privilege principles and ensuring that privileged authentication through vCenter Server remains tightly controlled.

NOTE: Nessus has provided the target output to assist in reviewing the benchmark to ensure target compliance.

Solution

Do not assign an interactive shell to vpxuser.
If the account was altered, restore the vendor-supported no-shell configuration or reconnect/recreate the vCenter host management account using supported vCenter procedures.

Impact:

Deactivating shell access prevents users from granting shell access to others or changing passwords of users who have shell access, necessitating host-by-host reconfiguration through an authorized account if changes are required. This could potentially impact third-party workflows and necessitates the retention of at least one fully privileged user for necessary configurations.

See Also

https://workbench.cisecurity.org/benchmarks/26357

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND INFORMATION INTEGRITY

References: 800-53|CM-7, 800-53|CM-7(1), 800-53|CM-7(5), 800-53|CM-10, 800-53|SI-7, 800-53|SI-7(1), CSCv7|2.7, CSCv7|2.8, CSCv7|2.9

Plugin: Unix

Control ID: 87a2732c65fa130f4c853a521ad42f3d02d3c8fa15df160706149e6f7792f7ac