CIS VMware ESXi 8 Benchmark

This recommendation verifies that ESXi Is Installed on Supported Hardware on the VMware ESXi 8 hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to eSXi Is Installed on Supported Hardware may leave the VMware ESXi 8 hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Verify against VMware HCL:
esxcli hardware platform get

# Install only on hardware listed in the VMware Compatibility Guide
# https://www.vmware.com/resources/compatibility

This recommendation verifies that the Image Profile Acceptance Level Is Appropriate on the VMware ESXi 8 hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to the Image Profile Acceptance Level Is Appropriate may leave the VMware ESXi 8 hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

esxcli software acceptance get
# Should be PartnerSupported or VMwareCertified

esxcli software acceptance set --level=PartnerSupported

This recommendation verifies that ESXi Is Running the Latest Patches on the VMware ESXi 8 hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to eSXi Is Running the Latest Patches may leave the VMware ESXi 8 hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

esxcli software vib list | head -20
esxcli software profile get

# Apply latest patches using vSphere Lifecycle Manager or:
esxcli software vib update -d /vmfs/volumes/datastore/patch.zip

This recommendation addresses the proper configuration of ESXi Firewall on the VMware ESXi 8 hypervisor. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of ESXi Firewall can lead to security gaps that may be exploited by attackers. A properly configured VMware ESXi 8 hypervisor reduces exposure to both known vulnerabilities and configuration drift.

esxcli network firewall get
esxcli network firewall ruleset list

esxcli network firewall set --enabled true
esxcli network firewall set --default-action DROP

This recommendation verifies that Firewall Rules Restrict Access to Management Services on the VMware ESXi 8 hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to firewall Rules Restrict Access to Management Services may leave the VMware ESXi 8 hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

esxcli network firewall ruleset allowedip list

esxcli network firewall ruleset set -r sshServer -a false
esxcli network firewall ruleset allowedip add -r sshServer -i 10.0.0.0/24

This recommendation verifies that Promiscuous Mode Is Rejected on the VMware ESXi 8 hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to promiscuous Mode Is Rejected may leave the VMware ESXi 8 hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

esxcli network vswitch standard policy security get --vswitch-name=vSwitch0
# PromiscuousMode should be false

esxcli network vswitch standard policy security set --vswitch-name=vSwitch0 --allow-promiscuous=false

This recommendation verifies that MAC Address Changes Are Rejected on the VMware ESXi 8 hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to mAC Address Changes Are Rejected may leave the VMware ESXi 8 hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

esxcli network vswitch standard policy security get --vswitch-name=vSwitch0
# MacChanges should be false

esxcli network vswitch standard policy security set --vswitch-name=vSwitch0 --allow-mac-change=false

This recommendation verifies that Forged Transmits Are Rejected on the VMware ESXi 8 hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to forged Transmits Are Rejected may leave the VMware ESXi 8 hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

esxcli network vswitch standard policy security get --vswitch-name=vSwitch0
# ForgedTransmits should be false

esxcli network vswitch standard policy security set --vswitch-name=vSwitch0 --allow-forged-transmits=false

This recommendation addresses the proper configuration of VLAN IDs on the VMware ESXi 8 hypervisor. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of VLAN IDs can lead to security gaps that may be exploited by attackers. A properly configured VMware ESXi 8 hypervisor reduces exposure to both known vulnerabilities and configuration drift.

esxcli network vswitch standard portgroup list

# Assign appropriate VLAN IDs; do not use VLAN 4095 (trunk) or native VLAN 1:
esxcli network vswitch standard portgroup set -p "VM Network" --vlan-id 100

This recommendation addresses the proper configuration of Remote Syslog on the VMware ESXi 8 hypervisor. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Remote Syslog can lead to security gaps that may be exploited by attackers. A properly configured VMware ESXi 8 hypervisor reduces exposure to both known vulnerabilities and configuration drift.

esxcli system syslog config get

esxcli system syslog config set --loghost=tcp://siem.example.com:514
esxcli system syslog reload

This recommendation addresses the proper configuration of Persistent Logging on the VMware ESXi 8 hypervisor. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Persistent Logging can lead to security gaps that may be exploited by attackers. A properly configured VMware ESXi 8 hypervisor reduces exposure to both known vulnerabilities and configuration drift.

esxcli system syslog config get | grep logdir
# Should point to a persistent datastore, not scratch

esxcli system syslog config set --logdir=/vmfs/volumes/datastore1/logs
esxcli system syslog reload

This recommendation verifies that NTP Is Configured and Running on the VMware ESXi 8 hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to nTP Is Configured and Running may leave the VMware ESXi 8 hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

esxcli system ntp get
esxcli system ntp config get

esxcli system ntp set --enabled=true --server=ntp1.example.com --server=ntp2.example.com

This recommendation verifies that Password Complexity Policy Is Set on the VMware ESXi 8 hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to password Complexity Policy Is Set may leave the VMware ESXi 8 hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

esxcli system security password get

esxcli system security password set --min-length=14 --min-uppercase=1 --min-lowercase=1 --min-numeric=1 --min-special=1

This recommendation addresses the proper configuration of Account Lockout on the VMware ESXi 8 hypervisor. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Account Lockout can lead to security gaps that may be exploited by attackers. A properly configured VMware ESXi 8 hypervisor reduces exposure to both known vulnerabilities and configuration drift.

esxcli system security account lockout get

esxcli system security account lockout set --max-failures=5 --unlock-time=900

This recommendation addresses the proper configuration of Active Directory Authentication on the VMware ESXi 8 hypervisor. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of Active Directory Authentication can lead to security gaps that may be exploited by attackers. A properly configured VMware ESXi 8 hypervisor reduces exposure to both known vulnerabilities and configuration drift.

esxcli system account list
# Check for AD-joined domain

# Join ESXi to AD domain via vSphere Client:
# Host → Configure → Authentication Services → Join Domain

This setting enforces that SSH Is Disabled Unless is required on the VMware ESXi 8 hypervisor. Making this mandatory ensures consistent security policy enforcement across the environment.

Failure to sSH Is Disabled Unless Required may leave the VMware ESXi 8 hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

esxcli system maintenanceMode get
/etc/init.d/SSH status

# Disable SSH:
esxcli system ssh set --enable=false

# Or via policy — auto-stop after timeout:
vim-cmd hostsvc/advopt/update UserVars.SuppressShellWarning long 0

This setting controls whether ESXi Shell is disabled on the VMware ESXi 8 hypervisor. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving ESXi Shell enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the VMware ESXi 8 hypervisor.

/etc/init.d/ESXShell status

vim-cmd hostsvc/enable_esx_shell 0
vim-cmd hostsvc/start_esx_shell 0

This recommendation configures the timeout for Shell on the VMware ESXi 8 hypervisor. Appropriate timeout values limit the window of opportunity for attacks and ensure resources are released in a timely manner.

Failure to shell Timeout Is Set may leave the VMware ESXi 8 hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

esxcli system settings advanced list -o /UserVars/ESXiShellInteractiveTimeOut

esxcli system settings advanced set -o /UserVars/ESXiShellInteractiveTimeOut -i 900

This setting controls whether VM Copy/Paste Operations is disabled on the VMware ESXi 8 hypervisor. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving VM Copy/Paste Operations enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the VMware ESXi 8 hypervisor.

# In .vmx file or via PowerCLI:
Get-VM | Get-AdvancedSetting -Name "isolation.tools.copy.disable"

Get-VM | New-AdvancedSetting -Name "isolation.tools.copy.disable" -Value "TRUE" -Force
Get-VM | New-AdvancedSetting -Name "isolation.tools.paste.disable" -Value "TRUE" -Force

This setting controls whether VM Drag & Drop is disabled on the VMware ESXi 8 hypervisor. Disabling this feature reduces the attack surface by removing unnecessary functionality that could be exploited by an attacker.

Leaving VM Drag & Drop enabled when it is not required unnecessarily expands the attack surface. An attacker could leverage this feature to gain unauthorized access or escalate privileges on the VMware ESXi 8 hypervisor.

Get-VM | Get-AdvancedSetting -Name "isolation.tools.dnd.disable"

Get-VM | New-AdvancedSetting -Name "isolation.tools.dnd.disable" -Value "TRUE" -Force

This recommendation verifies that VMs Cannot Modify Host Settings on the VMware ESXi 8 hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to vMs Cannot Modify Host Settings may leave the VMware ESXi 8 hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-VM | Get-AdvancedSetting -Name "isolation.tools.setinfo.disable"

Get-VM | New-AdvancedSetting -Name "isolation.tools.setinfo.disable" -Value "TRUE" -Force

Unnecessary Hardware Devices should be removed from the VMware ESXi 8 hypervisor when not required. Removing unnecessary components reduces the attack surface and limits the number of potential vulnerabilities that need to be managed.

Retaining Unnecessary Hardware Devices when it is not needed increases the attack surface. Unpatched or unused components are frequent targets for exploitation and should be removed as part of system hardening.

# Review VM hardware for unnecessary devices:
# Floppy drives, parallel/serial ports, USB controllers

# Remove unnecessary virtual hardware from VM settings:
# Edit Settings → Remove floppy, serial, parallel ports

This recommendation verifies that CD/DVD Drives Are Disconnected When Not In Use on the VMware ESXi 8 hypervisor. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to cD/DVD Drives Are Disconnected When Not In Use may leave the VMware ESXi 8 hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

Get-VM | Get-CDDrive | Where-Object {$_.ConnectionState.Connected -eq $true}

Get-VM | Get-CDDrive | Set-CDDrive -NoMedia -Confirm:$false

This recommendation addresses the proper configuration of iSCSI CHAP Authentication on the VMware ESXi 8 hypervisor. Proper configuration ensures the component operates securely and in accordance with organizational security policies.

Misconfiguration of iSCSI CHAP Authentication can lead to security gaps that may be exploited by attackers. A properly configured VMware ESXi 8 hypervisor reduces exposure to both known vulnerabilities and configuration drift.

esxcli iscsi adapter auth chap get

# Configure mutual CHAP authentication for iSCSI targets

This setting ensures that DCUI Access is restricted on the VMware ESXi 8 hypervisor. Restricting this capability limits potential abuse and enforces the principle of least privilege across the environment.

Unrestricted DCUI Access could allow unauthorized users or processes to perform actions beyond their intended scope. Applying least-privilege principles to the VMware ESXi 8 hypervisor is essential for defense in depth.

esxcli system settings advanced list -o /DCUI/Access

esxcli system settings advanced set -o /DCUI/Access -s "root"

This recommendation configures the timeout for DCUI on the VMware ESXi 8 hypervisor. Appropriate timeout values limit the window of opportunity for attacks and ensure resources are released in a timely manner.

Failure to dCUI Timeout Is Set may leave the VMware ESXi 8 hypervisor vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

esxcli system settings advanced list -o /UserVars/DcuiTimeOut

esxcli system settings advanced set -o /UserVars/DcuiTimeOut -i 600