Detections
Analytics

1.54 ESXI-80-000227

Information

The ESXi host must be configured with an appropriate maximum password age.

GROUP ID: V-258782
RULE ID: SV-258782r959010

The older an ESXi local account password is, the larger the opportunity window is for attackers to guess, crack or reuse a previously cracked password. Rotating passwords on a regular basis is a fundamental security practice and one that ESXi supports.

Solution

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Advanced System Settings.

Click "Edit". Select the "Security.PasswordMaxDays" value and configure it to "90".

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name Security.PasswordMaxDays | Set-AdvancedSetting -Value 90

See Also

https://workbench.cisecurity.org/benchmarks/23619

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-258782r959010_rule, STIG-ID|ESXI-80-000227, Vuln-ID|V-258782

Plugin: VMware

Control ID: 648e7c528dc471eeabc469a62ff7ff37c8fde0be62172ac94208d7f4eb02d024