The system must disable ESXi Shell unless needed for diagnostics or troubleshooting.

From VMware vSphere ESXi 6.0 Security Technical Implementation Guide

Associated with: CCI-000381

SV-77731r1_rule The system must disable ESXi Shell unless needed for diagnostics or troubleshooting.

Vulnerability discussion

The ESXi Shell is an interactive command line environment available locally from the DCUI or remotely via SSH. Activities performed from the ESXi Shell bypass vCenter RBAC and audit controls. The ESXi shell should only be turned on when needed to troubleshoot/resolve problems that cannot be fixed through the vSphere client.

Check content

From the vSphere Client select the ESXi Host and go to Configuration >> Security Profile. Under Services select Edit and view the "ESXi Shell" service and verify it is stopped. or From a PowerCLI command prompt while connected to the ESXi host run the following command: Get-VMHost | Get-VMHostService | Where {$_.Label -eq "ESXi Shell"} If the ESXi Shell service is running, this is a finding.

Fix text

From the vSphere Client select the ESXi Host and go to Configuration >> Security Profile. Under Services select Edit then select the ESXi Shell service and click options. Change the service to "Start and stop manually" and stop the service and click OK. or From a PowerCLI command prompt while connected to the ESXi host run the following commands: Get-VMHost | Get-VMHostService | Where {$_.Label -eq "ESXi Shell"} | Set-VMHostService -Policy Off Get-VMHost | Get-VMHostService | Where {$_.Label -eq "ESXi Shell"} | Stop-VMHostService

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.