The root account must not be used for direct logins.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
GEN001020-ESXI5-PNF	GEN001020-ESXI5-PNF	GEN001020-ESXI5-PNF_rule		Medium

Description
Direct login with the root account prevents individual user accountability. Acceptable non-routine uses of the root account for direct login are limited to emergency maintenance, the use of single-user mode for maintenance, and situations where individual administrator accounts are not available. Permanent finding - root can be used for direct login to the ESXI-v5 server if Lockdown Mode is disabled. As root is the primary administrator (and only local) account, it is not advisable to disable it. Also note that "no" login by root is allowed during normal (production) operational periods due to the Lockdown Mode requirement.

Description

Direct login with the root account prevents individual user accountability. Acceptable non-routine uses of the root account for direct login are limited to emergency maintenance, the use of single-user mode for maintenance, and situations where individual administrator accounts are not available. Permanent finding - root can be used for direct login to the ESXI-v5 server if Lockdown Mode is disabled. As root is the primary administrator (and only local) account, it is not advisable to disable it. Also note that "no" login by root is allowed during normal (production) operational periods due to the Lockdown Mode requirement.

STIG	Date
VMware ESXi v5 Security Technical Implementation Guide	2013-01-15

Details

Check Text ( C-GEN001020-ESXI5-PNF_chk )
ESXi supports this requirement and cannot be configured to be out of compliance. This is a permanent not a finding.

Fix Text (F-GEN001020-ESXI5-PNF_fix)
This requirement is permanent not a finding. No fix is required.