← Back to VMware vSphere 7.0 ESXi Security Technical Implementation Guide

V-256390

CAT II (Medium)

The ESXi host Secure Shell (SSH) daemon must not allow compression or must only allow compression after successful authentication.

Rule ID

SV-256390r959010_rule

STIG

VMware vSphere 7.0 ESXi Security Technical Implementation Guide

Version

V1R4

CCIs

CCI-000366

Discussion

If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.

Check Content

From an ESXi shell, run the following command:

# /usr/lib/vmware/openssh/bin/sshd -T|grep compression

Expected result:

compression no

If the output does not match the expected result, this is a finding.

Fix Text

From an ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":

Compression no