Detections
Analytics

3.10 Host must not suppress warnings that the shell is enabled

Information

Having warnings for enabled SSH or ESXi Shell provides insight into potential security risks. Disabling such warnings can mask ongoing attacks. The parameter governing this behavior is UserVars.SuppressShellWarning with a recommended value of 0.

Maintaining visibility of shell service status through warnings is crucial for monitoring and early detection of unauthorized activities, helping in promptly addressing potential security threats.

Solution

From an administrative PowerCLI session.

 - Execute Get-VMHost | Get-AdvancedSetting -Name UserVars.SuppressShellWarning | Set-AdvancedSetting -Value 0 -Confirm:$false
 - Shell access should normally remain disabled; do not suppress the warning when it is enabled.

Impact:

No negative functional impact is associated with this control; it enhances monitoring and response to potential security threats by ensuring warnings are visible and not suppressed.

See Also

https://workbench.cisecurity.org/benchmarks/28124

Item Details

Category: SYSTEM AND INFORMATION INTEGRITY

References: 800-53|SI-4, CSCv7|6.3

Plugin: VMware

Control ID: aea49ef26dd4b2ac60306d5c8ce142ad21526d2cf221fe54684a42e6010181fb