The system must configure the firewall to restrict access to services running on the host.

From VMware vSphere ESXi 6.0 Security Technical Implementation Guide

Part of SRG-OS-000480-VMM-002000

Associated with: CCI-000366

SV-77771r1_rule The system must configure the firewall to restrict access to services running on the host.

Vulnerability discussion

Unrestricted access to services running on an ESXi host can expose a host to outside attacks and unauthorized access. Reduce the risk by configuring the ESXi firewall to only allow access from authorized networks.

Check content

From the vSphere Client select the ESXi Host and go to Configuration >> Security Profile. Under the Firewall section select properties and for each enabled service click Firewall and review the allowed IPs. or From a PowerCLI command prompt while connected to the ESXi host run the following command: Get-VMHost | Get-VMHostFirewallException | Where {$_.Enabled -eq $true} | Select Name,Enabled,@{N="AllIPEnabled";E={$_.ExtensionData.AllowedHosts.AllIP}} If for an enabled service "Allow connections from any IP address" is selected, this is a finding.

Fix text

From the vSphere Client select the ESXi Host and go to Configuration >> Security Profile. Under the Firewall section select properties and for each enabled service click the "Only allow connections from the following networks" option and input the site specific network(s). or From a PowerCLI command prompt while connected to the ESXi host run the following command: $esxcli = Get-EsxCli #This disables the allow all rule for the target service $esxcli.network.firewall.ruleset.set($false,$true,"sshServer") $esxcli.network.firewall.ruleset.allowedip.add("192.168.0.0/24","sshServer") This must be done for each enabled service.

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.