From VMware vSphere ESXi 6.0 Security Technical Implementation Guide
Part of SRG-OS-000403-VMM-001640
Associated with: CCI-002470
To assure accountability and prevent unauthenticated access, privileged users must utilize multifactor authentication to prevent potential misuse and compromise of the system.
From the vSphere Web Client select the ESXi Host and go to Manage >> Authentication Services and view the Smart Card Authentication status. If "Enable Smart Card Authentication" is checked, the system requires smart cards to authentication to an Active Directory Domain. For systems that have no local user accounts, other than root and/or vpxuser, this is not applicable. For environments that do not use vCenter server to manage ESXi, this is not applicable. For systems that do not use smart cards with Active Directory and do have local user accounts, other than root and/or vpxuser, this is a finding.
The following are pre-requisites to configuration smart card authentication for the ESXi DCUI: -Active Directory domain that supports smart card authentication, smart card readers, and smart cards. -ESXi joined to an Active Directory domain. -Trusted certificates for root and intermediary certificate authorities. From the vSphere Web Client select the ESXi Host and go to Manage >> Authentication Services and edit the Smart Card Authentication configuration to add trusted certificate authority certificates and select "Enable Smart Card Authentication" and click OK. For more information see the vSphere 6.0 documentation on VMware's website.
Lavender hyperlinks in small type off to the right (of CSS
class id, if you view the page source) point to
globally unique URIs for each document and item. Copy the
link location and paste anywhere you need to talk
unambiguously about these things.
You can obtain data about documents and items in other
formats. Simply provide an HTTP header Accept:
text/turtle or
Accept: application/rdf+xml.
Powered by sagemincer