Detections
Analytics

ESXI-70-000002 - The ESXi host must verify the DCUI.Access list.

Information

Lockdown mode disables direct host access, requiring that administrators manage hosts from vCenter Server. However, if a host becomes isolated from vCenter, the administrator is locked out and can no longer manage the host.

The 'DCUI.Access' advanced setting allows specified users to exit lockdown mode in such a scenario. If the Direct Console User Interface (DCUI) is running in strict lockdown mode, this setting is ineffective.

Solution

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Advanced System Settings.

Click 'Edit'. Select the 'DCUI.Access' value and configure it to 'root'.

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name DCUI.Access | Set-AdvancedSetting -Value 'root'

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_7-0_Y25M04_STIG.zip

Item Details

Category: CONFIGURATION MANAGEMENT

References: 800-53|CM-6b., CAT|II, CCI|CCI-000366, Rule-ID|SV-256376r959010_rule, STIG-ID|ESXI-70-000002, Vuln-ID|V-256376

Plugin: VMware

Control ID: 21d6a8c6db226de0a6e5f4a57b8bd3e15b2f1ae9e59049a03878b08f463ca2e6