The VMM must automatically terminate a user session after inactivity timeouts have expired or at shutdown.

From VMware vSphere ESXi 6.0 Security Technical Implementation Guide

Associated with: CCI-002361

SV-78267r1_rule The VMM must automatically terminate a user session after inactivity timeouts have expired or at shutdown.

Vulnerability discussion

When the Direct console user interface (DCUI) is enabled and logged in it should be automatically logged out if left logged in to avoid unauthorized privilege gains. The DcuiTimeOut defines a window of time after which the DCUI will be logged out.

Check content

From the vSphere Client select the ESXi Host and go to Configuration >> Advanced Settings. Select the UserVars.DcuiTimeOut value and verify it is set to 600 (10 Minutes). or From a PowerCLI command prompt while connected to the ESXi host run the following command: Get-VMHost | Get-AdvancedSetting -Name UserVars.DcuiTimeOut If the UserVars.DcuiTimeOut setting is not set to 600, this is a finding.

Fix text

From the vSphere Client select the ESXi Host and go to Configuration >> Advanced Settings. Select the UserVars.DcuiTimeOut value and configure it to 600. or From a PowerCLI command prompt while connected to the ESXi host run the following commands: Get-VMHost | Get-AdvancedSetting -Name UserVars.DcuiTimeOut | Set-AdvancedSetting -Value 600

Pro Tips

Lavender hyperlinks in small type off to the right (of CSS class id, if you view the page source) point to globally unique URIs for each document and item. Copy the link location and paste anywhere you need to talk unambiguously about these things.

You can obtain data about documents and items in other formats. Simply provide an HTTP header Accept: text/turtle or Accept: application/rdf+xml.