The ESXi host must verify the exception users list for lockdown mode.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-207604	ESXI-65-000003	SV-207604r388482_rule		Low

Description
In vSphere you can add users to the Exception Users list from the vSphere Web Client. These users do not lose their permissions when the host enters lockdown mode. Usually you may want to add service accounts such as a backup agent to the Exception Users list. Verify that the list of users who are exempted from losing permissions is legitimate and as needed per your environment. Users who do not require special permissions should not be exempted from lockdown mode.

Description

In vSphere you can add users to the Exception Users list from the vSphere Web Client. These users do not lose their permissions when the host enters lockdown mode. Usually you may want to add service accounts such as a backup agent to the Exception Users list. Verify that the list of users who are exempted from losing permissions is legitimate and as needed per your environment. Users who do not require special permissions should not be exempted from lockdown mode.

STIG	Date
VMware vSphere 6.5 ESXi Security Technical Implementation Guide	2021-09-22

Details

Check Text ( C-7859r364211_chk )
From the vSphere Web Client select the ESXi Host and go to Configure >> System >> Security Profile. Under lockdown mode review the exception users list. or From a PowerCLI command prompt while connected to the ESXi host run the following script: $vmhost = Get-VMHost \| Get-View $lockdown = Get-View $vmhost.ConfigManager.HostAccessManager $lockdown.QueryLockdownExceptions() If the Exception users list contains accounts that do not require special permissions, this is a finding. Note - This list is not intended for system administrator accounts but for special circumstances such as a service account. For environments that do not use vCenter server to manage ESXi, this is not applicable.

Check Text ( C-7859r364211_chk )

From the vSphere Web Client select the ESXi Host and go to Configure >> System >> Security Profile. Under lockdown mode review the exception users list.

or

From a PowerCLI command prompt while connected to the ESXi host run the following script:

$vmhost = Get-VMHost | Get-View
$lockdown = Get-View $vmhost.ConfigManager.HostAccessManager
$lockdown.QueryLockdownExceptions()

If the Exception users list contains accounts that do not require special permissions, this is a finding.

Note - This list is not intended for system administrator accounts but for special circumstances such as a service account.

For environments that do not use vCenter server to manage ESXi, this is not applicable.

Fix Text (F-7859r364212_fix)
From the vSphere Web Client select the ESXi Host and go to Configure >> System >> Security Profile. Under lockdown mode click Edit and remove unnecessary users to the exceptions list.