Detections
Analytics

1.75 ESXI-80-000249

Information

The ESXi host must deny shell access for the dcui account.

GROUP ID: V-265976
RULE ID: SV-265976r1003584

The dcui user is used for process isolation for the DCUI itself. The account has shell access which can be deactivated to reduce attack surface.

Solution

From an ESXi shell, run the following command:

esxcli system account set -i dcui -s false

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

$esxcli = Get-EsxCli -v2
$arguments = $esxcli.system.account.set.CreateArgs()
$arguments.id = "dcui"
$arguments.shellaccess = "false"
$esxcli.system.account.set.invoke($arguments)

See Also

https://workbench.cisecurity.org/benchmarks/23619

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-265976r1003584_rule, STIG-ID|ESXI-80-000249, Vuln-ID|V-265976

Plugin: Unix

Control ID: cb6f216699ddd6757dea005abb18730a9575e6fdced2459cd60e60d09b75cfb1