Detections
Analytics

1.15 ESXI-80-000111

Information

The ESXi host must enforce an unlock timeout of 15 minutes after a user account is locked out.

GROUP ID: V-258742
RULE ID: SV-258742r1003564

By enforcing a reasonable unlock timeout after multiple failed logon attempts, the risk of unauthorized access via user password guessing, otherwise known as brute forcing, is reduced. Users must wait for the timeout period to elapse before subsequent logon attempts are allowed.

Solution

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Advanced System Settings.

Click "Edit". Select the "Security.AccountUnlockTime" value and configure it to "900".

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name Security.AccountUnlockTime | Set-AdvancedSetting -Value 900

See Also

https://workbench.cisecurity.org/benchmarks/23619

Item Details

Category: ACCESS CONTROL

References: 800-53|AC-7b., CAT|II, CCI|CCI-002238, Rule-ID|SV-258742r1003564_rule, STIG-ID|ESXI-80-000111, Vuln-ID|V-258742

Plugin: VMware

Control ID: 62272a7078563e525945a14aade45db39378bb87192d131353678777fdf496ee