The ESXi host must not suppress warnings that the local or remote shell sessions are enabled.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-256432	ESXI-70-000079	SV-256432r886077_rule		Medium

Description
Warnings that local or remote shell sessions are enabled alert administrators to activity they may not be aware of and need to investigate.

STIG	Date
VMware vSphere 7.0 ESXi Security Technical Implementation Guide	2023-02-21

Details

Check Text ( C-60107r886075_chk )
From the vSphere Client, go to Hosts and Clusters. Select the ESXi Host >> Configure >> System >> Advanced System Settings. Select the "UserVars.SuppressShellWarning" value and verify it is set to "0". or From a PowerCLI command prompt while connected to the ESXi host, run the following command: Get-VMHost \| Get-AdvancedSetting -Name UserVars.SuppressShellWarning If the "UserVars.SuppressShellWarning" setting is not set to "0" or the setting does not exist, this is a finding.

Check Text ( C-60107r886075_chk )

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Advanced System Settings.

Select the "UserVars.SuppressShellWarning" value and verify it is set to "0".

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name UserVars.SuppressShellWarning

If the "UserVars.SuppressShellWarning" setting is not set to "0" or the setting does not exist, this is a finding.

Fix Text (F-60050r886076_fix)
From the vSphere Client, go to Hosts and Clusters. Select the ESXi Host >> Configure >> System >> Advanced System Settings. Select the "UserVars.SuppressShellWarning" value and set it to "0". or From a PowerCLI command prompt while connected to the ESXi host, run the following command: Get-VMHost \| Get-AdvancedSetting -Name UserVars.SuppressShellWarning \| Set-AdvancedSetting -Value "0"