The system must disable SSH.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
SRG-OS-99999-ESXI5-000138	SRG-OS-99999-ESXI5-000138	SRG-OS-99999-ESXI5-000138_rule		Medium

Description
The ESXi Shell is an interactive command line interface (CLI) available at the ESXi server console. The ESXi shell provides temporary access to commands essential for server maintenance. Intended primarily for use in break-fix scenarios, the ESXi shell is well suited for checking and modifying configuration details, not always generally accessible, using the vSphere Client. The ESXi shell is accessible remotely using SSH. Under normal operating conditions, SSH access to the host must be disabled. As with the ESXi shell, SSH is also intended only for temporary use during break-fix scenarios, and must be disabled under normal operating conditions. Remote access to the host must therefore be limited to the vSphere Client at all other times.

Description

The ESXi Shell is an interactive command line interface (CLI) available at the ESXi server console. The ESXi shell provides temporary access to commands essential for server maintenance. Intended primarily for use in break-fix scenarios, the ESXi shell is well suited for checking and modifying configuration details, not always generally accessible, using the vSphere Client. The ESXi shell is accessible remotely using SSH. Under normal operating conditions, SSH access to the host must be disabled. As with the ESXi shell, SSH is also intended only for temporary use during break-fix scenarios, and must be disabled under normal operating conditions. Remote access to the host must therefore be limited to the vSphere Client at all other times.

STIG	Date
VMware ESXi v5 Security Technical Implementation Guide	2013-01-15

Details

Check Text ( C-SRG-OS-99999-ESXI5-000138_chk )
From the vSphere client, select the ESXi host, go to "Configuration >> Security Profile". In the "Services" section select "Properties". Verify 'SSH' is stopped. If the SSH service is running, this is a finding.

Fix Text (F-SRG-OS-99999-ESXI5-000138_fix)
From the vSphere client, select the ESXi host, go to "Configuration >> Security Profile". In the "Services" section select "Properties". Select "SSH", "Options..." and configure the 'SSH' option to "Start and stop manually".