UCF STIG Viewer Logo

Inetd and xinetd must be disabled or removed if no network services utilizing them are enabled.


Overview

Finding ID Version Rule ID IA Controls Severity
V-39386 SRG-OS-000095-ESXI5 SV-51244r2_rule High
Description
Unnecessary services should be disabled to decrease the attack surface of the system.
STIG Date
VMware ESXi Server 5.0 Security Technical Implementation Guide 2017-01-06

Details

Check Text ( C-46660r3_chk )
Temporarily disable Lockdown Mode and enable the ESXi Shell via the vSphere Client. Open the vSphere/VMware Infrastructure (VI) Client and log in with appropriate credentials. If connecting to vCenter Server, click on the desired host. Click the Configuration tab. Click Software, Security Profile, Services, Properties, ESXi Shell and Options, respectively. Start the ESXi Shell service, where/as required. As root, log in to the ESXi Shell and execute the following:
# egrep -v "^sshd|authd" /var/run/inetd.conf>

The above command filters for services other than sshd and/or authd. If any other services are found, ask the SA if the services are required (i.e., required by 3rd party software).

If services other than sshd and/or authd are found and cannot be accounted for, this is a finding.


Re-enable Lockdown Mode on the host.
Fix Text (F-44399r2_fix)
Temporarily disable Lockdown Mode and enable the ESXi Shell via the vSphere Client. Open the vSphere/VMware Infrastructure (VI) Client and log in with appropriate credentials. If connecting to vCenter Server, click on the desired host. Click the Configuration tab. Click Software, Security Profile, Services, Properties, ESXi Shell and Options, respectively. Start the ESXi Shell service, where/as required.

As root, log in to the ESXi Shell and edit the /var/run/inetd.conf file. Comment (do not remove) any service line entries that cannot be accounted for.

Re-enable Lockdown Mode on the host.