All non-interactive/automated processing account passwords must be changed at least once per year or be locked.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
GEN000740-ESXI5-PNF	GEN000740-ESXI5-PNF	GEN000740-ESXI5-PNF_rule		Medium

Description
Limiting the lifespan of authenticators limits the period of time an unauthorized user has access to the system while using compromised credentials and reduces the period of time available for password-guessing attacks to run against a single password. Locking the password for non-interactive and automated processing accounts is preferred as it removes the possibility of accessing the account by a password. On some systems, locking the passwords of these accounts may prevent the account from functioning properly. Passwords for non-interactive/automated processing accounts must not be used for direct logon to the system. Applicable, but permanent not-a-finding - Not a General Purpose (GP) OS. There are no non-interactive accounts excepting the vCenter vpxuser proxy which changes every 30 days or sooner if new ESXi-v5 hosts are added to the vCenter management list.

Description

Limiting the lifespan of authenticators limits the period of time an unauthorized user has access to the system while using compromised credentials and reduces the period of time available for password-guessing attacks to run against a single password. Locking the password for non-interactive and automated processing accounts is preferred as it removes the possibility of accessing the account by a password. On some systems, locking the passwords of these accounts may prevent the account from functioning properly. Passwords for non-interactive/automated processing accounts must not be used for direct logon to the system. Applicable, but permanent not-a-finding - Not a General Purpose (GP) OS. There are no non-interactive accounts excepting the vCenter vpxuser proxy which changes every 30 days or sooner if new ESXi-v5 hosts are added to the vCenter management list.

STIG	Date
VMware ESXi v5 Security Technical Implementation Guide	2013-01-15

Details

Check Text ( C-GEN000740-ESXI5-PNF_chk )
ESXi supports this requirement and cannot be configured to be out of compliance. This is a permanent not a finding.

Fix Text (F-GEN000740-ESXI5-PNF_fix)
This requirement is permanent not a finding. No fix is required.