The VMM must automatically terminate a user session after inactivity timeouts have expired or at shutdown by setting an idle timeout on shell services.

Overview

Finding ID	Version	Rule ID	IA Controls	Severity
V-63775	ESXI-06-100042	SV-78265r1_rule		Medium

Description
When the ESXi Shell or SSH services are enabled on a host they will run indefinitely. To avoid having these services left running set the ESXiShellTimeOut. The ESXiShellTimeOut defines a window of time after which the ESXi Shell and SSH services will automatically be terminated.

STIG	Date
VMware vSphere ESXi 6.0 Security Technical Implementation Guide	2017-07-11

Details

Check Text ( C-64525r1_chk )
From the vSphere Client select the ESXi Host and go to Configuration >> Advanced Settings. Select the UserVars.ESXiShellTimeOut value and verify it is set to 600 (10 Minutes). or From a PowerCLI command prompt while connected to the ESXi host run the following command: Get-VMHost \| Get-AdvancedSetting -Name UserVars.ESXiShellTimeOut If the UserVars.ESXiShellTimeOut setting is not set to 600, this is a finding.

Check Text ( C-64525r1_chk )

From the vSphere Client select the ESXi Host and go to Configuration >> Advanced Settings. Select the UserVars.ESXiShellTimeOut value and verify it is set to 600 (10 Minutes).

or

From a PowerCLI command prompt while connected to the ESXi host run the following command:

Get-VMHost | Get-AdvancedSetting -Name UserVars.ESXiShellTimeOut

If the UserVars.ESXiShellTimeOut setting is not set to 600, this is a finding.

Fix Text (F-69703r1_fix)
From the vSphere Client select the ESXi Host and go to Configuration >> Advanced Settings. Select the UserVars.ESXiShellTimeOut value and configure it to 600. or From a PowerCLI command prompt while connected to the ESXi host run the following commands: Get-VMHost \| Get-AdvancedSetting -Name UserVars.ESXiShellTimeOut \| Set-AdvancedSetting -Value 600