Note: This article covers material present in Version 1 Revision 3 and below. Topics found below may be mitigated in the most current version of the ESXi 5 STIG. Ensure you are using the most current version of the DISA STIG documents.
** Updated 9/9/13 to include distinction on Privilege Separation between v5.0 and 5.1 and above **
Note: All settings within the sshd_config file are case sensitive. Options are typically all lower case {yes|no} and are all expressed as <settings> <option> within the configuration file. The easiest way to verify an issue during your configuration is to have a second console open and run 'tail -f /var/log/auth.log' while attempting a connection.
I’m going to start with the SSH daemon findings. Why? Because it’s been a topic of conversation internally for the past few days, and it’s just littered with problems to talk about.
So, here’s the format we’re going to follow. I’m going to divide this into sections calling out the STIG ID and Rule Title. If the rule causes no issue I’ll call it out, but that will be about it. By the end of the article you’ll have a list of rules that you comply with, or at the very least you’ll know why you cannot. Here we go…
The SSH daemon settings in the ESXi 5 STIG pose a bit of a problem for those implementing them. To make it worse, there’s some confusion and lack of direction to several of the findings, plus one permanent finding that you cannot set on 5.0, but can on 5.1+. Let’s get started with the SSH daemon settings below. I’ll cover the SSH client settings in the next post. Continue reading