Check: ESXI-67-000032
VMware vSphere 6.7 ESXi STIG:
ESXI-67-000032
(in versions v1 r3 through v1 r1)
Title
The ESXi host must prohibit the reuse of passwords within five iterations. (Cat II impact)
Discussion
If a user or root used the same password continuously or was allowed to change it back shortly after being forced to change it to something else, it would provide a potential intruder with the opportunity to keep guessing at one user's password until it was guessed correctly.
Check Content
From the vSphere Client, select the ESXi host and go to Configure >> System >> Advanced System Settings. Select the "Security.PasswordHistory" value and verify it is set to "5". or From a PowerCLI command prompt while connected to the ESXi host, run the following command: Get-VMHost | Get-AdvancedSetting -Name Security.PasswordHistory If the "Security.PasswordHistory" setting is not set to "5", this is a finding.
Fix Text
From the vSphere Client, select the ESXi host and go to Configure >> System >> Advanced System Settings. Select the "Security.PasswordHistory" value and configure it to "5". or From a PowerCLI command prompt while connected to the ESXi host, run the following command: Get-VMHost | Get-AdvancedSetting -Name Security.PasswordHistory | Set-AdvancedSetting -Value 5
Additional Identifiers
Rule ID: SV-239287r674790_rule
Vulnerability ID: V-239287
Group Title: SRG-OS-000077-VMM-000440
Expert Comments
CCIs
Number | Definition |
---|---|
CCI-000200 |
The information system prohibits password reuse for the organization-defined number of generations. |
Controls
Number | Title |
---|---|
IA-5 (1) |
Password-Based Authentication |