STIGhubSTIGhub
STIGsSearchCompareAbout

STIGhub

A free tool to search and browse the entire DISA STIG library. Saves up to 75% in security compliance research time.

Navigation

  • Browse STIGs
  • Search
  • Compare Versions

Resources

  • About
  • VPAT
  • DISA STIG Library
STIGs updated 1 hour ago
Powered by Pylon
© 2026 Beacon Cloud Solutions, Inc. All rights reserved.
← Back to STIGs

VMware vSphere 8.0 ESXi Security Technical Implementation Guide

Version

V1R1

Release Date

Oct 11, 2023

SCAP Benchmark ID

VMW_vSphere_8-0_ESXi_STIG

Total Checks

73

Tags

vmware
CAT I: 5CAT II: 63CAT III: 5

This Security Technical Implementation Guide is published as a tool to improve the security of Department of Defense (DOD) information systems. The requirements are derived from the National Institute of Standards and Technology (NIST) 800-53 and related documents. Comments or proposed revisions to this document should be sent via email to the following address: disa.stig_spt@mail.mil.

Export CKLExport CSVExport JSONDownload STIG ZIP

Checks (73)

V-258728MEDIUMThe ESXi host must enforce the limit of three consecutive invalid logon attempts by a user.V-258729MEDIUMThe ESXi host must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the system via the Direct Console User Interface (DCUI).V-258730MEDIUMThe ESXi host must enable lockdown mode.V-258731MEDIUMThe ESXi host client must be configured with an idle session timeout.V-258732HIGHThe ESXi host Secure Shell (SSH) daemon must use FIPS 140-2 validated cryptographic modules to protect the confidentiality of remote access sessions.V-258733MEDIUMThe ESXi must produce audit records containing information to establish what type of events occurred.V-258734MEDIUMThe ESXi host must enforce password complexity by configuring a password quality policy.V-258735MEDIUMThe ESXi host must prohibit password reuse for a minimum of five generations.V-258736MEDIUMThe ESXi host must be configured to disable nonessential capabilities by disabling the Managed Object Browser (MOB).V-258737LOWThe ESXi host must uniquely identify and must authenticate organizational users by using Active Directory.V-258738MEDIUMThe ESXi host Secure Shell (SSH) daemon must ignore .rhosts files.V-258739MEDIUMThe ESXi host must set a timeout to automatically end idle shell sessions after fifteen minutes.V-258740MEDIUMThe ESXi host must implement Secure Boot enforcement.V-258741MEDIUMThe ESXi host must enable Secure Boot.V-258742MEDIUMThe ESXi host must enforce an unlock timeout of 15 minutes after a user account is locked out.V-258743MEDIUMThe ESXi host must allocate audit record storage capacity to store at least one week's worth of audit records.V-258744MEDIUMThe ESXi host must off-load logs via syslog.V-258745MEDIUMThe ESXi host must synchronize internal information system clocks to an authoritative time source.V-258746HIGHThe ESXi Image Profile and vSphere Installation Bundle (VIB) acceptance level must be verified.V-258747MEDIUMThe ESXi host must enable bidirectional Challenge-Handshake Authentication Protocol (CHAP) authentication for Internet Small Computer Systems Interface (iSCSI) traffic.V-258748MEDIUMThe ESXi host must protect the confidentiality and integrity of transmitted information by isolating vMotion traffic.V-258749HIGHThe ESXi host must maintain the confidentiality and integrity of information during transmission by exclusively enabling Transport Layer Security (TLS) 1.2.V-258750MEDIUMThe ESXi host Secure Shell (SSH) daemon must be configured to only use FIPS 140-2 validated ciphers.V-258751MEDIUMThe ESXi host DCUI.Access list must be verified.V-258752MEDIUMThe ESXi host must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the system via Secure Shell (SSH).V-258753MEDIUMThe ESXi host Secure Shell (SSH) daemon must display the Standard Mandatory DOD Notice and Consent Banner before granting access to the system.V-258754MEDIUMThe ESXi host must be configured to disable nonessential capabilities by disabling Secure Shell (SSH).V-258755MEDIUMThe ESXi host must be configured to disable nonessential capabilities by disabling the ESXi shell.V-258756MEDIUMThe ESXi host must automatically stop shell services after 10 minutes.V-258757MEDIUMThe ESXi host must set a timeout to automatically end idle DCUI sessions after 10 minutes.V-258758MEDIUMThe ESXi host must protect the confidentiality and integrity of transmitted information by isolating ESXi management traffic.V-258759MEDIUMThe ESXi host must protect the confidentiality and integrity of transmitted information by isolating IP-based storage traffic.V-258760MEDIUMThe ESXi host lockdown mode exception users list must be verified.V-258761MEDIUMThe ESXi host Secure Shell (SSH) daemon must not allow host-based authentication.V-258762MEDIUMThe ESXi host Secure Shell (SSH) daemon must not permit user environment settings.V-258763LOWThe ESXi host Secure Shell (SSH) daemon must be configured to not allow gateway ports.V-258764MEDIUMThe ESXi host Secure Shell (SSH) daemon must not permit tunnels.V-258765LOWThe ESXi host Secure Shell (SSH) daemon must set a timeout count on idle sessions.V-258766LOWThe ESXi host Secure Shell (SSH) daemon must set a timeout interval on idle sessions.V-258767MEDIUMThe ESXi host must disable Simple Network Management Protocol (SNMP) v1 and v2c.V-258768LOWThe ESXi host must disable Inter-Virtual Machine (VM) Transparent Page Sharing.V-258769MEDIUMThe ESXi host must configure the firewall to block network traffic by default.V-258770MEDIUMThe ESXi host must enable Bridge Protocol Data Units (BPDU) filter on the host to prevent being locked out of physical switch ports with Portfast and BPDU Guard enabled.V-258771MEDIUMThe ESXi host must configure virtual switch security policies to reject forged transmits.V-258772HIGHThe ESXi host must configure virtual switch security policies to reject Media Access Control (MAC) address changes.V-258773MEDIUMThe ESXi host must configure virtual switch security policies to reject promiscuous mode requests.V-258774MEDIUMThe ESXi host must restrict use of the dvFilter network application programming interface (API).V-258775MEDIUMThe ESXi host must restrict the use of Virtual Guest Tagging (VGT) on standard switches.V-258776HIGHThe ESXi host must have all security patches and updates installed.V-258777MEDIUMThe ESXi host must not suppress warnings that the local or remote shell sessions are enabled.V-258778MEDIUMThe ESXi host must not suppress warnings about unmitigated hyperthreading vulnerabilities.V-258779MEDIUMThe ESXi host must verify certificates for SSL syslog endpoints.V-258780MEDIUMThe ESXi host must enable volatile key destruction.V-258781MEDIUMThe ESXi host must configure a session timeout for the vSphere API.V-258782MEDIUMThe ESXi host must be configured with an appropriate maximum password age.V-258783MEDIUMThe ESXi Common Information Model (CIM) service must be disabled.V-258784MEDIUMThe ESXi host must use DOD-approved certificates.V-258785MEDIUMThe ESXi host Secure Shell (SSH) daemon must disable port forwarding.V-258786MEDIUMThe ESXi host OpenSLP service must be disabled.V-258787MEDIUMThe ESXi host must enable audit logging.V-258788MEDIUMThe ESXi host must off-load audit records via syslog.V-258789MEDIUMThe ESXi host must enable strict x509 verification for SSL syslog endpoints.V-258790MEDIUMThe ESXi host must forward audit records containing information to establish what type of events occurred.V-258791MEDIUMThe ESXi host must not be configured to override virtual machine (VM) configurations.V-258792MEDIUMThe ESXi host must not be configured to override virtual machine (VM) logger settings.V-258793MEDIUMThe ESXi host must require TPM-based configuration encryption.V-258794MEDIUMThe ESXi host must configure the firewall to restrict access to services running on the host.V-258795MEDIUMThe ESXi host when using Host Profiles and/or Auto Deploy must use the vSphere Authentication Proxy to protect passwords when adding themselves to Active Directory.V-258796MEDIUMThe ESXi host must not use the default Active Directory ESX Admin group.V-258797MEDIUMThe ESXi host must configure a persistent log location for all locally stored logs.V-258798MEDIUMThe ESXi host must enforce the exclusive running of executables from approved VIBs.V-258799MEDIUMThe ESXi host must use sufficient entropy for cryptographic operations.V-258800MEDIUMThe ESXi host must not enable log filtering.