The operating system must notify, as required, appropriate individuals for account termination.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-OS-000277-ESXI5-PNF	SRG-OS-000277-ESXI5-PNF	SRG-OS-000277-ESXI5-PNF_rule		Medium

Description
Monitoring account termination is critical to ensure a denial of service situation does not exist on the operating system. An unexpected account termination can also be a sign of a rogue administrator account that may be deleting traces of activity. In order to facilitate the monitoring, the operating system must notify designated personnel when an account is terminated. Permanent not a finding - Root is the only user local to the host. All other accounts required to be AD accounts (addressed in the VMware HG). Root account auditing is captured in the system logs sent to a remote syslog server (requirement). Auditing is enabled by default and cannot be configured/disabled like similar UNIX-like systems. Account actions are logged; however, AD accounts are the responsibility of the AD server.

Description

Monitoring account termination is critical to ensure a denial of service situation does not exist on the operating system. An unexpected account termination can also be a sign of a rogue administrator account that may be deleting traces of activity. In order to facilitate the monitoring, the operating system must notify designated personnel when an account is terminated. Permanent not a finding - Root is the only user local to the host. All other accounts required to be AD accounts (addressed in the VMware HG). Root account auditing is captured in the system logs sent to a remote syslog server (requirement). Auditing is enabled by default and cannot be configured/disabled like similar UNIX-like systems. Account actions are logged; however, AD accounts are the responsibility of the AD server.

STIG	Date
VMware ESXi v5 Security Technical Implementation Guide	2013-01-15

Details

Check Text ( C-SRG-OS-000277-ESXI5-PNF_chk )
ESXi supports this requirement and cannot be configured to be out of compliance. This is a permanent not a finding.

Fix Text (F-SRG-OS-000277-ESXI5-PNF_fix)
This requirement is permanent not a finding. No fix is required.