Detections
Analytics
ESXI-65-000029 - The ESXi host must remove keys from the SSH authorized_keys file.
Information
ESXi hosts come with SSH which can be enabled to allow remote access without requiring user authentication. To enable password free access copy the remote users public key into the '/etc/ssh/keys-root/authorized_keys' file on the ESXi host. The presence of the remote user's public key in the 'authorized_keys' file identifies the user as trusted, meaning the user is granted access to the host without providing a password. If using Lockdown Mode and SSH is disabled then login with authorized keys will have the same restrictions as username/password.Solution
From an SSH session connected to the ESXi host, or from the ESXi shell, zero or remove the /etc/ssh/keys-root/authorized_keys file:# >/etc/ssh/keys-root/authorized_keys
or
# rm /etc/ssh/keys-root/authorized_keys
See Also
https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_VMW_vSphere_6-5_Y20M04_STIG.zip
Item Details
Audit Name: DISA STIG VMware vSphere ESXi OS 6.5 v1r4
Category: CONFIGURATION MANAGEMENT
References: 800-53|CM-6, CAT|II, CCI|CCI-000366, Rule-ID|SV-104091r1_rule, STIG-ID|ESXI-65-000029, Vuln-ID|V-94005
Plugin: Unix
Control ID: 8ed51c9a50d4b954de8b6931af7e51743e1e7247ea2729c8c3b5f4d25f62176b