The ESXi host must enforce the exclusive running of executables from approved VIBs.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-258798	ESXI-80-000244	SV-258798r959010_rule		Medium

Description
The "execInstalledOnly" advanced ESXi boot option, when set to TRUE, guarantees that the VMkernel executes only those binaries that have been packaged as part of a signed VIB. While this option is effective on its own, it can be further enhanced by telling the Secure Boot to check with the TPM to make sure that the boot process does not proceed unless this setting is enabled. This further protects against malicious offline changes to ESXi configuration to disable the "execInstalledOnly" option.

Description

The "execInstalledOnly" advanced ESXi boot option, when set to TRUE, guarantees that the VMkernel executes only those binaries that have been packaged as part of a signed VIB. While this option is effective on its own, it can be further enhanced by telling the Secure Boot to check with the TPM to make sure that the boot process does not proceed unless this setting is enabled. This further protects against malicious offline changes to ESXi configuration to disable the "execInstalledOnly" option.

STIG	Date
VMware vSphere 8.0 ESXi Security Technical Implementation Guide	2024-07-11

Details

Check Text ( C-62538r933453_chk )
If the ESXi host does not have a compatible TPM, this finding is downgraded to a CAT III. From the vSphere Client, go to Hosts and Clusters. Select the ESXi Host >> Configure >> System >> Advanced System Settings. Select the "VMkernel.Boot.execInstalledOnly" value and verify that it is "true". or From a PowerCLI command prompt while connected to the ESXi host, run the following command: Get-VMHost \| Get-AdvancedSetting -Name VMkernel.Boot.execInstalledOnly If the "VMkernel.Boot.execInstalledOnly" setting is not "true", this is a finding.

Check Text ( C-62538r933453_chk )

If the ESXi host does not have a compatible TPM, this finding is downgraded to a CAT III.

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Advanced System Settings.

Select the "VMkernel.Boot.execInstalledOnly" value and verify that it is "true".

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name VMkernel.Boot.execInstalledOnly

If the "VMkernel.Boot.execInstalledOnly" setting is not "true", this is a finding.

Fix Text (F-62447r933454_fix)
From the vSphere Client, go to Hosts and Clusters. Select the ESXi Host >> Configure >> System >> Advanced System Settings. Click "Edit". Select the "VMkernel.Boot.execInstalledOnly" value and configure it to "true". or From a PowerCLI command prompt while connected to the ESXi host, run the following command: Get-VMHost \| Get-AdvancedSetting -Name VMkernel.Boot.execInstalledOnly \| Set-AdvancedSetting -Value True

Fix Text (F-62447r933454_fix)

From the vSphere Client, go to Hosts and Clusters.

Select the ESXi Host >> Configure >> System >> Advanced System Settings.

Click "Edit". Select the "VMkernel.Boot.execInstalledOnly" value and configure it to "true".

or

From a PowerCLI command prompt while connected to the ESXi host, run the following command:

Get-VMHost | Get-AdvancedSetting -Name VMkernel.Boot.execInstalledOnly | Set-AdvancedSetting -Value True