Please provide your feedback in this short Flings' survey.
fling logo of DoD Security Technical Implementation Guide(STIG) ESXi VIB

DoD Security Technical Implementation Guide(STIG) ESXi VIB

version 7.0_1.0.0 — March 29, 2021

Summary

The DoD Security Technical Implementation Guide ('STIG') ESXi VIB is a Fling that provides a custom VMware-signed ESXi vSphere Installation Bundle ('VIB') to assist in remediating Defense Information Systems Agency STIG controls for ESXi. This VIB has been developed to help customers rapidly implement the more challenging aspects of the vSphere STIG. These include the fact that installation is time consuming and must be done manually on the ESXi hosts. In certain cases, it may require complex scripting, or even development of an in-house VIB that would not be officially digitally signed by VMware (and therefore would not be deployed as a normal patch would). The need for a VMware-signed VIB is due to the system level files that are to be replaced. These files cannot be modified at a community supported acceptance level. The use of the VMware-signed STIG VIB provides customers the following benefits:
  • The ability to use vSphere Update Manager ('VUM') to quickly deploy the VIB to ESXi hosts (you cannot do this with a customer created VIB)
  • The ability to use VUM to quickly check if all ESXi hosts have the STIG VIB installed and therefore are also in compliance
  • No need to manually replace and copy files directly on each ESXi host in your environment
  • No need to create complex shell scripts that run each time ESXi boots to re-apply settings
stigvib-large

Requirements

ESXi 5.x and 6.0 are supported but each have a different set of VIBs as the vSphere 5.0 and 6.0 STIGs have different requirements.

The following VIBs are provided for each ESXi version as follows:

ESXi 5.x

  • dod-esxi5-stig-rd
  • dod-esxi5-stig-re

ESXi 6.0

  • dod-esxi6-stig-rd
  • dod-esxi6-stig-re

Multiple versions of each VIB were created as marked by the “rd” and “re” in the filename. This designation is for root SSH enabled (“re”) and root SSH deactivated (“rd"). This designation is for root SSH enabled and root SSH deactivated. Depending on your organizational policies and whether or not it is possible to join ESXi to Active Directory will dictate which VIB fits your needs.

STIG ID SRG-OS-000109-ESXI5 for 5.0 and STIG ID ESXI-06-000014 for 6.0 requires root logins to be deactivated via SSH.

Changelog

Update March 2021

  • New ESXi 7.0 STIG VIB release
  • Updated sshd_config file to meet the ESXi 7.0 Draft STIG which is also now the default config in 7.0 U2 with the exception of permitting root user logins.
  • Removed /etc/vmware/welcome file from VIB since it can be configured via the UI or PowerCLI now with issue.
  • Draft ESXi content can be found here: https://github.com/vmware/dod-compliance-and-automation/tree/master/vsphere/7.0/docs
  • See the updated Overview and Installation guide included in the download.

Update September 2019

  • New ESXi 6.7 STIG VIB release
  • Updated sshd_config file. Removed protocol 2 setting as it is deprecated. Added "FipsMode yes" setting. Updated Ciphers and MACs for newer version of OpenSSH
  • Removed /etc/issue and /etc/pam.d/passwd files from VIB as those settings can be set via advanced settings now
  • Note - This VIB is based on draft STIG content! It is recommended to use this over the previous 6.5-7 STIG VIB

Update August 2018

  • Updated 6.5 STIG VIB to resolve issue with it not being applicable to 6.7 in VUM.
  • Also updated package to replace 6.0 version and root deactivated or root enabled for the same version if you are switching between them.

Update January 2018

  • Added 6.5 STIG VIB to the downloads section. **Please note this is not based on a DISA STIG as a 6.5 STIG has not been released**

Update August 2016

  • Updated 6.0 STIG VIB for the version 1 release 2 STIG. Added new ciphers in the sshd_config file
  • Updated 5.x STIG VIB for the version 1 release 9 STIG. Removed AllowGroups setting in the sshd_config file
  • Added MD5 and SHA1 hashes to the contents
  • Updated documentation file

Similar Flings

No similar flings found. Check these out instead...
Jan 04, 2022
fling logo of VM News Collector

VM News Collector

version 1.0

VM News Collector is a real-time news aggregator dedicated to the collection of all kinds of real-time news updates and applicable information & resolutions on all technology products belonging to the VMWARE Group, a technology giant, leading the technology revolution in cloud computing & virtualization fields.
No need to scroll through hundreds of documents looking for informations. VM News Collector App has it all for you.

Aug 15, 2016
Jul 19, 2016
fling logo of VMware Modified Enhanced SCAP Content Editor

VMware Modified Enhanced SCAP Content Editor

version 1.0

VMware Modified Enhanced SCAP Content Editor is an updated version of the Enhanced SCAP Content Editor too by G2, Inc, and is an open source project, vmware-scap-edit, on GitHub.

May 09, 2019
fling logo of Distributed Trust Incident Reporting

Distributed Trust Incident Reporting

version 1.0

Security incidents are important to track so that all parties know the status of a breach and can respond in concert and with appropriate speed. Current methods to track incidents are generally paper-based manual processes.

Aug 25, 2014
fling logo of BatchV2V

BatchV2V

version 1.0

BatchV2V is a command line utility that helps to simplify batch V2V operations utilizing VMware Converter. On first run, BatchV2V outputs a configuration file that can be used multiple times to batch copy one virtual machine to many other targets. For many administrators, this is done manually on a regularly scheduled basis with VMware Converter.

Oct 17, 2013
fling logo of StatsFeeder

StatsFeeder

version 4.1.685

Statsfeeder is a tool that enables performance metrics to be retrieved from vCenter and sent to multiple destinations, including 3rd party systems.

View More