Detections
Analytics

ESXI-67-000034 - The ESXi host must disable the Managed Object Browser (MOB).

Information

The MOB provides a way to explore the object model used by the VMkernel to manage the host and enables configurations to be changed as well. This interface is meant to be used primarily for debugging the vSphere SDK, but because there are no access controls it could also be used as a method to obtain information about a host being targeted for unauthorized access.

Solution

From the vSphere Client, select the ESXi Host and go to Configure >> System >> Advanced System Settings.

Click 'Edit' and select the 'Config.HostAgent.plugins.solo.enableMob' value and configure it to 'false'.

or

From a PowerCLI command prompt while connected to the ESXi host, run the following commands:

Get-VMHost | Get-AdvancedSetting -Name Config.HostAgent.plugins.solo.enableMob | Set-AdvancedSetting -Value false

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-7_Y23M07_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-7a., CAT|II, CCI|CCI-000381, Rule-ID|SV-239289r674796_rule, STIG-ID|ESXI-67-000034, Vuln-ID|V-239289

Plugin: VMware

Control ID: 13dc2a33730ab33f2e29b9b3e1aee0342cd0f6269303c19be316c56eeab3e1e0