Finding ID | Version | Rule ID | IA Controls | Severity |
---|---|---|---|---|
V-239299 | ESXI-67-000044 | SV-239299r816576_rule | Low |
Description |
---|
In the event of a system failure, the system must preserve any information necessary to determine cause of failure and any information necessary to return to operations with least disruption to mission processes. |
STIG | Date |
---|---|
VMware vSphere 6.7 ESXi Security Technical Implementation Guide | 2022-01-05 |
Check Text ( C-42532r816575_chk ) |
---|
From the vSphere Client, select the ESXi host and right-click. If the "Add Diagnostic Partition" option is greyed out, core dumps are configured. or From a PowerCLI command prompt while connected to the ESXi host, run the following commands: $esxcli = Get-EsxCli -v2 $esxcli.system.coredump.partition.get.Invoke() $esxcli.system.coredump.network.get.Invoke() The first command prepares for the other two. The second command shows whether an active core dump partition is configured. The third command shows whether a network core dump collector is configured and enabled via the "HostVNic", "NetworkServerIP", "NetworkServerPort", and "Enabled" variables. If there is an active core dump partition, via the second command, this is not a finding. If there is a network core dump collector configured and enabled, this is not a finding. If there is no core dump partition and no network core dump collector configured, this is a finding. |
Fix Text (F-42491r674825_fix) |
---|
From the vSphere Client, select the ESXi host and right-click. Select the "Add Diagnostic Partition" option to configure a core dump diagnostic partition. or From a PowerCLI command prompt while connected to the ESXi host, run at least one of the following sets of commands: To configure a core dump partition: $esxcli = Get-EsxCli -v2 #View available partitions to configure $esxcli.system.coredump.partition.list.Invoke() $arguments = $esxcli.system.coredump.partition.set.CreateArgs() $arguments.partition = " $esxcli.system.coredump.partition.set.Invoke($arguments) #You can't set the partition and enable it at the same time so now we can enable it $arguments = $esxcli.system.coredump.partition.set.CreateArgs() $arguments.enable = $true $esxcli.system.coredump.partition.set.Invoke($arguments) To configure a core dump collector: $esxcli = Get-EsxCli -v2 $arguments = $esxcli.system.coredump.network.set.CreateArgs() $arguments.interfacename = " $arguments.serverip = " $arguments.serverport = " $arguments = $esxcli.system.coredump.network.set.Invoke($arguments) $arguments = $esxcli.system.coredump.network.set.CreateArgs() $arguments.enable = $true $arguments = $esxcli.system.coredump.network.set.Invoke($arguments) |