Detections
Analytics

1.23 ESXI-80-000189

Information

The ESXi host DCUI.Access list must be verified.

GROUP ID: V-258751
RULE ID: SV-258751r959010

Lockdown mode disables direct host access, requiring that administrators manage hosts from vCenter Server. However, if a host becomes isolated from vCenter, the administrator is locked out and can no longer manage the host.

The "DCUI.Access" advanced setting allows specified users to exit lockdown mode in such a scenario. If the Direct Console User Interface (DCUI) is running in strict lockdown mode, this setting is ineffective.

Solution

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Advanced System Settings.

Click "Edit". Select the "DCUI.Access" value and configure it to "root".

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name DCUI.Access | Set-AdvancedSetting -Value "root"

See Also

https://workbench.cisecurity.org/benchmarks/23619

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-258751r959010_rule, STIG-ID|ESXI-80-000189, Vuln-ID|V-258751

Plugin: VMware

Control ID: 1f10207f2b2bf4eb58179072964a5a7f7805f76b2312a4c99fa691c5b4ba1e7d