Detections
Analytics
ESXI-65-000009 - The ESXi host SSH daemon must be configured with the Department of Defense (DoD) login banner.
Information
The warning message reinforces policy awareness during the logon process and facilitates possible legal action against attackers. Alternatively, systems whose ownership should not be obvious should ensure usage of a banner that does not provide easy attribution.Solution
From an SSH session connected to the ESXi host, or from the ESXi shell, add or correct the following line in '/etc/ssh/sshd_config':Banner /etc/issue
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-5_Y20M04_STIG.zip
Item Details
Audit Name: DISA STIG VMware vSphere ESXi OS 6.5 v1r4
Category: ACCESS CONTROL
References: 800-53|AC-8, CAT|II, CCI|CCI-000048, Rule-ID|SV-104051r1_rule, STIG-ID|ESXI-65-000009, Vuln-ID|V-93965
Plugin: Unix
Control ID: 0db8e35569375ad20a6a1d6c1a01c83cbf6ff140fe2e471d0eca53a9fdf05457