Detections
Analytics
SRG-OS-000109-ESXI5 - The system must not permit root logins using remote access programs, such as SSH.
Information
Even though communications are encrypted, an additional layer of security may be gained by extending the policy of not logging directly on as root. In addition, logging in with a user-specific account preserves the audit trail.NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
This step assumes that root access to the system is available via the vSphere Client/vCenter Server, local availability via the DCUI, or that remote systems are accessible at the remote site via touch labor by an authorized (root) user.Disable lock down mode. Enable the ESXi Shell. Execute the following command(s):
# vi /etc/ssh/sshd_config
Add/modify the attribute line entry to the following (quotes for emphasis only):
'PermitRootLogin no'
Re-enable lock down mode.
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_ESXi5_Server_V2R1_STIG.zip
Item Details
Audit Name: DISA VMWare ESXi 5.0 Server STIG v2r1
Category: IDENTIFICATION AND AUTHENTICATION
References: 800-53|IA-2(5), CAT|II, CCI|CCI-000770, Group-ID|V-39391, Rule-ID|SV-250629r798886_rule, STIG-ID|SRG-OS-000109-ESXI5, STIG-Legacy|SV-51249, STIG-Legacy|V-39391, Vuln-ID|V-250629
Plugin: VMware
Control ID: 92df7bcccda71c36cac1cfd74eb3ea14b8d7d0ad479b99c97bd573f6b76c565e