Detections
Analytics

1.12 Host integrated hardware management controller must deactivate internal networking

Information

Many servers have integrated hardware management controllers with the ability to present virtual network interfaces to ESXi as a management interface. These approaches create potential backdoors for access and are used by adversaries to circumvent network-based/perimeter firewalls, in either direction, and avoid observation by IDS/IPS/threat analysis tools. In many cases this functionality is not strictly necessary to manage hosts.

Using integrated hardware management controllers to present virtual network interfaces to ESXi can inadvertently create backdoors, allowing adversaries to bypass firewalls and evade detection by security tools; often, this functionality isn't essential for host management.

Solution

To disable ESXi BMC internal networking:

 - execute esxcfg-advcfg -s 0 /Net/BMCNetworkEnable
 - execute esxcfg-advcfg -g /Net/BMCNetworkEnable

Looking for: Value of BMCNetworkEnable is 0

Impact:

Disablement of internal networking may limit vendor management tool effectiveness.

See Also

https://workbench.cisecurity.org/benchmarks/26357

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6, 800-53|CM-7, CSCv7|11.7

Plugin: VMware

Control ID: 4e94841bb4b6837c9a5d9066a5a3dc9c099fc3d354e3cf9e893e94e00622f147