The SSH daemon must be configured for IP filtering.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
GEN005540-ESXI5-PNF	GEN005540-ESXI5-PNF	GEN005540-ESXI5-PNF_rule		Medium

Description
The SSH daemon must be configured for IP filtering to provide a layered defense against connection attempts from unauthorized addresses. Applicable, but permanent not-a-finding - no tcp wrappers. Per GEN005504, the sshd_config file is required to be configured for ListenAddress, which filters IP Addresses (and further filtering is available via the SSH daemon firewall entries which are also necessary for enablement of SSHD).

Description

The SSH daemon must be configured for IP filtering to provide a layered defense against connection attempts from unauthorized addresses. Applicable, but permanent not-a-finding - no tcp wrappers. Per GEN005504, the sshd_config file is required to be configured for ListenAddress, which filters IP Addresses (and further filtering is available via the SSH daemon firewall entries which are also necessary for enablement of SSHD).

STIG	Date
VMware ESXi v5 Security Technical Implementation Guide	2013-01-15

Details

Check Text ( C-GEN005540-ESXI5-PNF_chk )
ESXi supports this requirement and cannot be configured to be out of compliance. This is a permanent not a finding.

Fix Text (F-GEN005540-ESXI5-PNF_fix)
This requirement is permanent not a finding. No fix is required.