The operating system must use organization-defined replay-resistant authentication mechanisms for network access to non-privileged accounts.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-39413	SRG-OS-000113-ESXI5	SV-51271r2_rule		High

Description
An authentication process resists replay attacks if it is impractical to achieve a successful authentication by recording and replaying a previous authentication message. Techniques used to address this include protocols using challenges (e.g., TLS, WS_Security), time synchronous, or challenge-response one-time authenticators.

STIG	Date
VMware ESXi Server 5.0 Security Technical Implementation Guide	2017-01-06

Details

Check Text ( C-46687r2_chk )
Disable lock down mode. Enable the ESXi Shell. Check the SSH client configuration for required protocol. # grep -i "Protocol 2" /etc/ssh/ssh_config | grep -v '^#' Re-enable lock down mode. If the returned protocol list contains anything except 2, this is a finding. If the /etc/ssh/ssh_config file does not exist or the Protocol option is not set, this is not a finding.

Fix Text (F-44426r1_fix)
Disable lock down mode. Enable the ESXi Shell. Edit the SSH client configuration and add/modify the "Protocol" configuration for Protocol 2 only. # vi /etc/ssh/ssh_config Re-enable lock down mode.