vHoge

VMwareのアレコレ備忘録。CLIでがんばるネタ多め。

vSphere 8 SCG の PowerCLI スクリプトを試してみる

先日の Japan VMUG vExpert が語る会 #30 にて、「今だからこそ vSphere Security Configuration and Hardening Guide」 というお題にて久々に登壇してきました。

発表資料

speakerdeck.com

アーカイブ動画

準備中…

その中で

vSphere 8 の Security Configuration and Hardening Guide にて監査してくれる PowerCLI スクリプトが同梱されたが、環境ないので誰か試してーという話をしましたが、せっかくブログに書けそうなネタなので、誰かに消費されてしまう前に試してみる。

監査対象

vCenter はとりあえずデプロイしただけのデフォルト環境でデータセンタ/クラスタを作成、nested の 8.0U2 ホストを登録。
ESXi もデフォルトですが、いつものクセで SSH だけ有効にした状態。

vSphere 8 SCG の監査スクリプト

vSphere 8 の SCG zip ファイルを解凍後の tools にディレクトリに ps1 のスクリプトが並んでいます。

この中で vCenter/ESXi/VM 全監査であろう ”audit-all.ps1"を動かしてみる。

実行してみる

PS D:\vmware-vsphere-security-configuration-guide-802-20231005-01\Tools> .\audit-all.ps1

cmdlet audit-all.ps1 at command pipeline position 1
Supply values for the following parameters:
Directory: result               #結果の保存先ディレクトリを指定
[INFO] VMware vSphere Security Configuration & Hardening Guide 802-20230930-01
[INFO] vSphere Security Settings Audit Utility
[INFO]
[ERROR] Please connect to a single vCenter Server (use Connect-VIServer, Connect-CisServer, and Connect-SsoAdminServer) prior to running this script. Thank you.

ありゃ…事前にコネクションを取得必要があるらしい。

PS D:\vmware-vsphere-security-configuration-guide-802-20231005-01\Tools> Connect-VIServer 192.168.100.104 -Force

Specify Credential
Please specify server credential
User: administrator@vsphere.local
Password for user administrator@vsphere.local: *************


Name                           Port  User
----                           ----  ----
192.168.100.104                443   VSPHERE.LOCAL\Administrato

再挑戦。

PS D:\vmware-vsphere-security-configuration-guide-802-20231005-01\Tools> .\audit-all.ps1

cmdlet audit-all.ps1 at command pipeline position 1
Supply values for the following parameters:
Directory: result
[INFO] VMware vSphere Security Configuration & Hardening Guide 802-20230930-01
[INFO] vSphere Security Settings Audit Utility
[INFO]
vCLS-d50ef15f-7df6-4e94-8809-7afd00541836:   [INFO] Audit of vCLS-d50ef15f-7df6-4e94-8809-7afd00541836 started at 2023-10-30 20:04:39 from HAKUTAKA by mirie
vCLS-d50ef15f-7df6-4e94-8809-7afd00541836:   [INFO]
vCLS-d50ef15f-7df6-4e94-8809-7afd00541836:  [ERROR] VM may be a vSphere appliance. Altering VMware virtual appliances is not supported.
192.168.100.45:   [INFO] Audit of 192.168.100.45 started at 2023-10-30 20:04:39 from HAKUTAKA by mirie
192.168.100.45:   [INFO]
192.168.100.45:   [FAIL] Net.BMCNetworkEnable not configured correctly (1)
192.168.100.45:   [PASS] UserVars.SuppressHyperthreadWarning configured correctly (0)
192.168.100.45:   [PASS] UserVars.ESXiVPsDisabledProtocols configured correctly (sslv3,tlsv1,tlsv1.1)
192.168.100.45:   [FAIL] Syslog.global.logLevel not configured correctly (error)
192.168.100.45:   [PASS] Security.AccountLockFailures configured correctly (5)
192.168.100.45:   [FAIL] VMkernel.Boot.execInstalledOnly not configured correctly (False)
192.168.100.45:   [FAIL] UserVars.ESXiShellTimeOut not configured correctly (0)
192.168.100.45:   [PASS] Net.BlockGuestBPDU configured correctly (1)
192.168.100.45:   [PASS] Config.HostAgent.vmacore.soap.sessionTimeout configured correctly (30)
192.168.100.45:   [PASS] Security.AccountUnlockTime configured correctly (900)
192.168.100.45:   [FAIL] Security.PasswordQualityControl not configured correctly (retry=3 min=disabled,disabled,disabled,7,7)
192.168.100.45:   [PASS] Security.PasswordHistory configured correctly (5)
192.168.100.45:   [PASS] UserVars.SuppressShellWarning configured correctly (0)
192.168.100.45:   [PASS] Syslog.global.certificate.checkSSLCerts configured correctly (True)
192.168.100.45:   [FAIL] Syslog.global.auditRecord.remoteEnable not configured correctly (False)
192.168.100.45:   [PASS] UserVars.DcuiTimeOut configured correctly (600)
192.168.100.45:   [PASS] Config.HostAgent.plugins.solo.enableMob configured correctly (False)
192.168.100.45:   [FAIL] Syslog.global.auditRecord.storageCapacity not configured correctly (4)
192.168.100.45:   [FAIL] Syslog.global.auditRecord.storageEnable not configured correctly (False)
192.168.100.45:   [PASS] Security.PasswordMaxDays configured correctly (99999)
192.168.100.45:   [FAIL] Mem.MemEagerZero not configured correctly (0)
192.168.100.45:   [FAIL] UserVars.ESXiShellInteractiveTimeOut not configured correctly (0)
192.168.100.45:   [PASS] Mem.ShareForceSalting configured correctly (2)
192.168.100.45:   [PASS] Syslog.global.logFiltersEnable configured correctly (False)
192.168.100.45:   [PASS] UserVars.HostClientSessionTimeout configured correctly (900)
192.168.100.45:   [FAIL] Syslog.global.certificate.strictX509Compliance not configured correctly (False)
192.168.100.45:   [PASS] DCUI.Access configured correctly (root)
192.168.100.45:   [PASS] Config.HostAgent.log.level configured correctly (info)
192.168.100.45:   [PASS] Net.DVFilterBindIpAddress configured correctly ()
192.168.100.45:   [FAIL] Syslog.global.auditRecord.storageDirectory not configured correctly ([] /scratch/auditLog)
192.168.100.45:   [FAIL] Syslog.global.logDir not configured correctly ([] /scratch/log)
192.168.100.45:   [FAIL] Syslog.global.logHost not configured correctly ()
192.168.100.45:   [FAIL] Annotations.WelcomeMessage not configured correctly ()
192.168.100.45:   [FAIL] Config.Etc.Issue not configured correctly ()
192.168.100.45:   [FAIL] DCUI user has shell access enabled (true)
192.168.100.45:   [PASS] Entropy sources configured correctly (FALSE, 0)
192.168.100.45:   [FAIL] Secure Boot enforcement is not enabled (false)
192.168.100.45:   [FAIL] TPM configuration encryption is not enabled (NONE)
192.168.100.45:   [PASS] Host Image Profile Acceptance Level is configured correctly (PartnerSupported)
192.168.100.45:   [PASS] Active Directory integration is configured correctly ()
192.168.100.45:   [PASS] SSH has FIPS mode enabled (true)
192.168.100.45:   [PASS] SSH ciphers configured correctly (aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr)
192.168.100.45:   [PASS] SSH gatewayports configured correctly (no)
192.168.100.45:   [PASS] SSH hostbasedauthentication configured correctly (no)
192.168.100.45:   [PASS] SSH clientalivecountmax configured correctly (3)
192.168.100.45:   [PASS] SSH clientaliveinterval configured correctly (200)
192.168.100.45:   [PASS] SSH banner configured correctly (/etc/issue)
192.168.100.45:   [PASS] SSH ignorerhosts configured correctly (yes)
192.168.100.45:   [PASS] SSH allowstreamlocalforwarding configured correctly (no)
192.168.100.45:   [PASS] SSH allowtcpforwarding configured correctly (no)
192.168.100.45:   [PASS] SSH permittunnel configured correctly (no)
192.168.100.45:   [PASS] SSH permituserenvironment configured correctly (no)
192.168.100.45:   [PASS] sfcbd-watchdog is not running (False)
192.168.100.45:   [FAIL] sfcbd-watchdog is configured to start (on)
192.168.100.45:   [FAIL] TSM is running (True)
192.168.100.45:   [FAIL] TSM is configured to start (on)
192.168.100.45:   [PASS] slpd is not running (False)
192.168.100.45:   [PASS] slpd is not configured to start (off)
192.168.100.45:   [PASS] snmpd is not running (False)
192.168.100.45:   [FAIL] snmpd is configured to start (on)
192.168.100.45:   [FAIL] TSM-SSH is running (True)
192.168.100.45:   [FAIL] TSM-SSH is configured to start (on)
192.168.100.45:   [FAIL] ntpd is running (False)
192.168.100.45:   [FAIL] ntpd is configured to start (off)
192.168.100.45:   [FAIL] NTP client not configured ()
192.168.100.45:   [FAIL] Lockdown Mode exception users not configured correctly ()
192.168.100.45:   [FAIL] Lockdown Mode is not configured correctly (lockdownDisabled)
192.168.100.45:   [PASS] Standard switch 'vSwitch0' is not configured to allow promiscuous mode (False)
192.168.100.45:   [PASS] Standard switch 'vSwitch0' is not configured to allow MAC address changes (False)
192.168.100.45:   [PASS] Standard switch 'vSwitch0' is not configured to allow forged transmits (False)
192.168.100.45:   [PASS] Standard portgroup 'Management Network' is not configured to allow promiscuous mode (False)
192.168.100.45:   [PASS] Standard portgroup 'Management Network' is not configured to allow MAC address changes (False)
192.168.100.45:   [PASS] Standard portgroup 'Management Network' is not configured to allow forged transmits (False)
192.168.100.45:   [PASS] Standard portgroup 'Management Network' is not configured to allow VLAN 4095 (0)
192.168.100.45:   [PASS] Standard portgroup 'Management Network' does not appear to be configured to use a default VLAN (0)
192.168.100.45:   [PASS] Standard portgroup 'VM Network' is not configured to allow promiscuous mode (False)
192.168.100.45:   [PASS] Standard portgroup 'VM Network' is not configured to allow MAC address changes (False)
192.168.100.45:   [PASS] Standard portgroup 'VM Network' is not configured to allow forged transmits (False)
192.168.100.45:   [PASS] Standard portgroup 'VM Network' is not configured to allow VLAN 4095 (0)
192.168.100.45:   [PASS] Standard portgroup 'VM Network' does not appear to be configured to use a default VLAN (0)
192.168.100.45:   [PASS] VMkernel NIC 'vmk0' has only management configured (ManagementTrafficEnabled: True, VMotionEnabled: False, FaultToleranceLoggingEnabled: False, VsanTrafficEnabled: False, ProvisioningEnabled: False, VSphereReplicationEnabled: False, VSphereReplicationNFCEnabled: False, VSphereBackupNFCEnabled: False)
192.168.100.104:   [INFO] Audit of 192.168.100.104 started at 2023-10-30 20:04:46 from HAKUTAKA by mirie
192.168.100.104:   [INFO]
192.168.100.104:   [PASS] config.log.level configured correctly (info)
192.168.100.104:   [PASS] vpxd.event.syslog.enabled configured correctly (True)
192.168.100.104:   [PASS] VirtualCenter.VimPasswordExpirationInDays configured correctly (30)
192.168.100.104:   [PASS] etc.issue configured correctly ( VMware vCenter Server Appliance 8.0.2.00000  )
Get-SsoLockoutPolicy: D:\vmware-vsphere-security-configuration-guide-802-20231005-01\Tools\audit-vcenter-8.ps1:127
Line |
 127 |  $value = Get-SsoLockoutPolicy
     |           ~~~~~~~~~~~~~~~~~~~~
     | The term 'Get-SsoLockoutPolicy' is not recognized as a name of a cmdlet, function, script file, or executable
     | program. Check the spelling of the name, or if a path was included, verify that the path is correct and try
     | again.
192.168.100.104:   [FAIL] SSO AutoUnlockIntervalSec not configured correctly ()
192.168.100.104:   [FAIL] SSO FailedAttemptIntervalSec not configured correctly ()
192.168.100.104:   [FAIL] SSO MaxFailedAttempts not configured correctly ()
Get-SsoPasswordPolicy: D:\vmware-vsphere-security-configuration-guide-802-20231005-01\Tools\audit-vcenter-8.ps1:148
Line |
 148 |  $value = Get-SsoPasswordPolicy
     |           ~~~~~~~~~~~~~~~~~~~~~
     | The term 'Get-SsoPasswordPolicy' is not recognized as a name of a cmdlet, function, script file, or executable
     | program. Check the spelling of the name, or if a path was included, verify that the path is correct and try
     | again.
192.168.100.104:   [FAIL] SSO PasswordLifetimeDays not configured correctly ()
192.168.100.104:   [FAIL] SSO ProhibitedPreviousPasswordsCount not configured correctly ()
192.168.100.104:   [FAIL] SSO MinLength not configured correctly ()
192.168.100.104:   [FAIL] SSO MaxLength not configured correctly ()
192.168.100.104:   [FAIL] SSO MinNumericCount not configured correctly ()
192.168.100.104:   [FAIL] SSO MinSpecialCharCount not configured correctly ()
192.168.100.104:   [FAIL] SSO MaxIdenticalAdjacentCharacters not configured correctly ()
192.168.100.104:   [FAIL] SSO MinAlphabeticCount not configured correctly ()
192.168.100.104:   [FAIL] SSO MinUppercaseCount not configured correctly ()
192.168.100.104:   [FAIL] SSO MinLowercaseCount not configured correctly ()

んー…なんか対応していない cmdlet があるな…？
と調べてみるとどうも標準で入っていないモジュールがあるっぽい。

www.powershellgallery.com

PowerShell Gallery からインストール。

PS D:\vmware-vsphere-security-configuration-guide-802-20231005-01\Tools> Install-Module -Name VMware.vSphere.SsoAdmin

Untrusted repository
You are installing the modules from an untrusted repository. If you trust this repository, change its
InstallationPolicy value by running the Set-PSRepository cmdlet. Are you sure you want to install the modules from
'PSGallery'?
[Y] Yes  [A] Yes to All  [N] No  [L] No to All  [S] Suspend  [?] Help (default is "N"): Y

再々挑戦

PS D:\vmware-vsphere-security-configuration-guide-802-20231005-01\Tools> .\audit-all.ps1

cmdlet audit-all.ps1 at command pipeline position 1
Supply values for the following parameters:
Directory: result
[INFO] VMware vSphere Security Configuration & Hardening Guide 802-20230930-01
[INFO] vSphere Security Settings Audit Utility
[INFO]
vCLS-d50ef15f-7df6-4e94-8809-7afd00541836:   [INFO] Audit of vCLS-d50ef15f-7df6-4e94-8809-7afd00541836 started at 2023-10-30 20:11:36 from HAKUTAKA by mirie
vCLS-d50ef15f-7df6-4e94-8809-7afd00541836:   [INFO]
vCLS-d50ef15f-7df6-4e94-8809-7afd00541836:  [ERROR] VM may be a vSphere appliance. Altering VMware virtual appliances is not supported.
192.168.100.45:   [INFO] Audit of 192.168.100.45 started at 2023-10-30 20:11:36 from HAKUTAKA by mirie
192.168.100.45:   [INFO]
192.168.100.45:   [FAIL] Net.BMCNetworkEnable not configured correctly (1)
192.168.100.45:   [PASS] UserVars.SuppressHyperthreadWarning configured correctly (0)
192.168.100.45:   [PASS] UserVars.ESXiVPsDisabledProtocols configured correctly (sslv3,tlsv1,tlsv1.1)
192.168.100.45:   [FAIL] Syslog.global.logLevel not configured correctly (error)
192.168.100.45:   [PASS] Security.AccountLockFailures configured correctly (5)
192.168.100.45:   [FAIL] VMkernel.Boot.execInstalledOnly not configured correctly (False)
192.168.100.45:   [FAIL] UserVars.ESXiShellTimeOut not configured correctly (0)
192.168.100.45:   [PASS] Net.BlockGuestBPDU configured correctly (1)
192.168.100.45:   [PASS] Config.HostAgent.vmacore.soap.sessionTimeout configured correctly (30)
192.168.100.45:   [PASS] Security.AccountUnlockTime configured correctly (900)
192.168.100.45:   [FAIL] Security.PasswordQualityControl not configured correctly (retry=3 min=disabled,disabled,disabled,7,7)
192.168.100.45:   [PASS] Security.PasswordHistory configured correctly (5)
192.168.100.45:   [PASS] UserVars.SuppressShellWarning configured correctly (0)
192.168.100.45:   [PASS] Syslog.global.certificate.checkSSLCerts configured correctly (True)
192.168.100.45:   [FAIL] Syslog.global.auditRecord.remoteEnable not configured correctly (False)
192.168.100.45:   [PASS] UserVars.DcuiTimeOut configured correctly (600)
192.168.100.45:   [PASS] Config.HostAgent.plugins.solo.enableMob configured correctly (False)
192.168.100.45:   [FAIL] Syslog.global.auditRecord.storageCapacity not configured correctly (4)
192.168.100.45:   [FAIL] Syslog.global.auditRecord.storageEnable not configured correctly (False)
192.168.100.45:   [PASS] Security.PasswordMaxDays configured correctly (99999)
192.168.100.45:   [FAIL] Mem.MemEagerZero not configured correctly (0)
192.168.100.45:   [FAIL] UserVars.ESXiShellInteractiveTimeOut not configured correctly (0)
192.168.100.45:   [PASS] Mem.ShareForceSalting configured correctly (2)
192.168.100.45:   [PASS] Syslog.global.logFiltersEnable configured correctly (False)
192.168.100.45:   [PASS] UserVars.HostClientSessionTimeout configured correctly (900)
192.168.100.45:   [FAIL] Syslog.global.certificate.strictX509Compliance not configured correctly (False)
192.168.100.45:   [PASS] DCUI.Access configured correctly (root)
192.168.100.45:   [PASS] Config.HostAgent.log.level configured correctly (info)
192.168.100.45:   [PASS] Net.DVFilterBindIpAddress configured correctly ()
192.168.100.45:   [FAIL] Syslog.global.auditRecord.storageDirectory not configured correctly ([] /scratch/auditLog)
192.168.100.45:   [FAIL] Syslog.global.logDir not configured correctly ([] /scratch/log)
192.168.100.45:   [FAIL] Syslog.global.logHost not configured correctly ()
192.168.100.45:   [FAIL] Annotations.WelcomeMessage not configured correctly ()
192.168.100.45:   [FAIL] Config.Etc.Issue not configured correctly ()
192.168.100.45:   [FAIL] DCUI user has shell access enabled (true)
192.168.100.45:   [PASS] Entropy sources configured correctly (FALSE, 0)
192.168.100.45:   [FAIL] Secure Boot enforcement is not enabled (false)
192.168.100.45:   [FAIL] TPM configuration encryption is not enabled (NONE)
192.168.100.45:   [PASS] Host Image Profile Acceptance Level is configured correctly (PartnerSupported)
192.168.100.45:   [PASS] Active Directory integration is configured correctly ()
192.168.100.45:   [PASS] SSH has FIPS mode enabled (true)
192.168.100.45:   [PASS] SSH ciphers configured correctly (aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr)
192.168.100.45:   [PASS] SSH gatewayports configured correctly (no)
192.168.100.45:   [PASS] SSH hostbasedauthentication configured correctly (no)
192.168.100.45:   [PASS] SSH clientalivecountmax configured correctly (3)
192.168.100.45:   [PASS] SSH clientaliveinterval configured correctly (200)
192.168.100.45:   [PASS] SSH banner configured correctly (/etc/issue)
192.168.100.45:   [PASS] SSH ignorerhosts configured correctly (yes)
192.168.100.45:   [PASS] SSH allowstreamlocalforwarding configured correctly (no)
192.168.100.45:   [PASS] SSH allowtcpforwarding configured correctly (no)
192.168.100.45:   [PASS] SSH permittunnel configured correctly (no)
192.168.100.45:   [PASS] SSH permituserenvironment configured correctly (no)
192.168.100.45:   [PASS] sfcbd-watchdog is not running (False)
192.168.100.45:   [FAIL] sfcbd-watchdog is configured to start (on)
192.168.100.45:   [FAIL] TSM is running (True)
192.168.100.45:   [FAIL] TSM is configured to start (on)
192.168.100.45:   [PASS] slpd is not running (False)
192.168.100.45:   [PASS] slpd is not configured to start (off)
192.168.100.45:   [PASS] snmpd is not running (False)
192.168.100.45:   [FAIL] snmpd is configured to start (on)
192.168.100.45:   [FAIL] TSM-SSH is running (True)
192.168.100.45:   [FAIL] TSM-SSH is configured to start (on)
192.168.100.45:   [FAIL] ntpd is running (False)
192.168.100.45:   [FAIL] ntpd is configured to start (off)
192.168.100.45:   [FAIL] NTP client not configured ()
192.168.100.45:   [FAIL] Lockdown Mode exception users not configured correctly ()
192.168.100.45:   [FAIL] Lockdown Mode is not configured correctly (lockdownDisabled)
192.168.100.45:   [PASS] Standard switch 'vSwitch0' is not configured to allow promiscuous mode (False)
192.168.100.45:   [PASS] Standard switch 'vSwitch0' is not configured to allow MAC address changes (False)
192.168.100.45:   [PASS] Standard switch 'vSwitch0' is not configured to allow forged transmits (False)
192.168.100.45:   [PASS] Standard portgroup 'Management Network' is not configured to allow promiscuous mode (False)
192.168.100.45:   [PASS] Standard portgroup 'Management Network' is not configured to allow MAC address changes (False)
192.168.100.45:   [PASS] Standard portgroup 'Management Network' is not configured to allow forged transmits (False)
192.168.100.45:   [PASS] Standard portgroup 'Management Network' is not configured to allow VLAN 4095 (0)
192.168.100.45:   [PASS] Standard portgroup 'Management Network' does not appear to be configured to use a default VLAN (0)
192.168.100.45:   [PASS] Standard portgroup 'VM Network' is not configured to allow promiscuous mode (False)
192.168.100.45:   [PASS] Standard portgroup 'VM Network' is not configured to allow MAC address changes (False)
192.168.100.45:   [PASS] Standard portgroup 'VM Network' is not configured to allow forged transmits (False)
192.168.100.45:   [PASS] Standard portgroup 'VM Network' is not configured to allow VLAN 4095 (0)
192.168.100.45:   [PASS] Standard portgroup 'VM Network' does not appear to be configured to use a default VLAN (0)
192.168.100.45:   [PASS] VMkernel NIC 'vmk0' has only management configured (ManagementTrafficEnabled: True, VMotionEnabled: False, FaultToleranceLoggingEnabled: False, VsanTrafficEnabled: False, ProvisioningEnabled: False, VSphereReplicationEnabled: False, VSphereReplicationNFCEnabled: False, VSphereBackupNFCEnabled: False)
192.168.100.104:   [INFO] Audit of 192.168.100.104 started at 2023-10-30 20:11:42 from HAKUTAKA by mirie
192.168.100.104:   [INFO]
192.168.100.104:   [PASS] config.log.level configured correctly (info)
192.168.100.104:   [PASS] vpxd.event.syslog.enabled configured correctly (True)
192.168.100.104:   [PASS] VirtualCenter.VimPasswordExpirationInDays configured correctly (30)
192.168.100.104:   [PASS] etc.issue configured correctly ( VMware vCenter Server Appliance 8.0.2.00000  )
192.168.100.104:   [FAIL] SSO AutoUnlockIntervalSec not configured correctly ()
192.168.100.104:   [FAIL] SSO FailedAttemptIntervalSec not configured correctly ()
192.168.100.104:   [FAIL] SSO MaxFailedAttempts not configured correctly ()
192.168.100.104:   [FAIL] SSO PasswordLifetimeDays not configured correctly ()
192.168.100.104:   [FAIL] SSO ProhibitedPreviousPasswordsCount not configured correctly ()
192.168.100.104:   [FAIL] SSO MinLength not configured correctly ()
192.168.100.104:   [FAIL] SSO MaxLength not configured correctly ()
192.168.100.104:   [FAIL] SSO MinNumericCount not configured correctly ()
192.168.100.104:   [FAIL] SSO MinSpecialCharCount not configured correctly ()
192.168.100.104:   [FAIL] SSO MaxIdenticalAdjacentCharacters not configured correctly ()
192.168.100.104:   [FAIL] SSO MinAlphabeticCount not configured correctly ()
192.168.100.104:   [FAIL] SSO MinUppercaseCount not configured correctly ()
192.168.100.104:   [FAIL] SSO MinLowercaseCount not configured correctly ()
PS D:\vmware-vsphere-security-configuration-guide-802-20231005-01\Tools>

スクリプト自体は完走したっぽい？
(発表中だと vSphere 7 だと動かないみたいな話をしたけど、モジュールが不足していただけ？)

結果を見てみる

vCenter / ESXi / VM 毎に結果がテキストで吐かれているが、さきほどのコンソール出力がインベントリ毎にテキストに保存されただけっぽいな…

192.168.100.104.txt

192.168.100.104:   [INFO] Audit of 192.168.100.104 started at 2023-10-30 20:11:42 from HAKUTAKA by mirie
192.168.100.104:   [INFO]
192.168.100.104:   [PASS] config.log.level configured correctly (info)
192.168.100.104:   [PASS] vpxd.event.syslog.enabled configured correctly (True)
192.168.100.104:   [PASS] VirtualCenter.VimPasswordExpirationInDays configured correctly (30)
192.168.100.104:   [PASS] etc.issue configured correctly ( VMware vCenter Server Appliance 8.0.2.00000  )
192.168.100.104:   [FAIL] SSO AutoUnlockIntervalSec not configured correctly ()
192.168.100.104:   [FAIL] SSO FailedAttemptIntervalSec not configured correctly ()
192.168.100.104:   [FAIL] SSO MaxFailedAttempts not configured correctly ()
192.168.100.104:   [FAIL] SSO PasswordLifetimeDays not configured correctly ()
192.168.100.104:   [FAIL] SSO ProhibitedPreviousPasswordsCount not configured correctly ()
192.168.100.104:   [FAIL] SSO MinLength not configured correctly ()
192.168.100.104:   [FAIL] SSO MaxLength not configured correctly ()
192.168.100.104:   [FAIL] SSO MinNumericCount not configured correctly ()
192.168.100.104:   [FAIL] SSO MinSpecialCharCount not configured correctly ()
192.168.100.104:   [FAIL] SSO MaxIdenticalAdjacentCharacters not configured correctly ()
192.168.100.104:   [FAIL] SSO MinAlphabeticCount not configured correctly ()
192.168.100.104:   [FAIL] SSO MinUppercaseCount not configured correctly ()
192.168.100.104:   [FAIL] SSO MinLowercaseCount not configured correctly ()

192.168.100.45.txt

192.168.100.45:   [INFO] Audit of 192.168.100.45 started at 2023-10-30 20:11:36 from HAKUTAKA by mirie
192.168.100.45:   [INFO]
192.168.100.45:   [FAIL] Net.BMCNetworkEnable not configured correctly (1)
192.168.100.45:   [PASS] UserVars.SuppressHyperthreadWarning configured correctly (0)
192.168.100.45:   [PASS] UserVars.ESXiVPsDisabledProtocols configured correctly (sslv3,tlsv1,tlsv1.1)
192.168.100.45:   [FAIL] Syslog.global.logLevel not configured correctly (error)
192.168.100.45:   [PASS] Security.AccountLockFailures configured correctly (5)
192.168.100.45:   [FAIL] VMkernel.Boot.execInstalledOnly not configured correctly (False)
192.168.100.45:   [FAIL] UserVars.ESXiShellTimeOut not configured correctly (0)
192.168.100.45:   [PASS] Net.BlockGuestBPDU configured correctly (1)
192.168.100.45:   [PASS] Config.HostAgent.vmacore.soap.sessionTimeout configured correctly (30)
192.168.100.45:   [PASS] Security.AccountUnlockTime configured correctly (900)
192.168.100.45:   [FAIL] Security.PasswordQualityControl not configured correctly (retry=3 min=disabled,disabled,disabled,7,7)
192.168.100.45:   [PASS] Security.PasswordHistory configured correctly (5)
192.168.100.45:   [PASS] UserVars.SuppressShellWarning configured correctly (0)
192.168.100.45:   [PASS] Syslog.global.certificate.checkSSLCerts configured correctly (True)
192.168.100.45:   [FAIL] Syslog.global.auditRecord.remoteEnable not configured correctly (False)
192.168.100.45:   [PASS] UserVars.DcuiTimeOut configured correctly (600)
192.168.100.45:   [PASS] Config.HostAgent.plugins.solo.enableMob configured correctly (False)
192.168.100.45:   [FAIL] Syslog.global.auditRecord.storageCapacity not configured correctly (4)
192.168.100.45:   [FAIL] Syslog.global.auditRecord.storageEnable not configured correctly (False)
192.168.100.45:   [PASS] Security.PasswordMaxDays configured correctly (99999)
192.168.100.45:   [FAIL] Mem.MemEagerZero not configured correctly (0)
192.168.100.45:   [FAIL] UserVars.ESXiShellInteractiveTimeOut not configured correctly (0)
192.168.100.45:   [PASS] Mem.ShareForceSalting configured correctly (2)
192.168.100.45:   [PASS] Syslog.global.logFiltersEnable configured correctly (False)
192.168.100.45:   [PASS] UserVars.HostClientSessionTimeout configured correctly (900)
192.168.100.45:   [FAIL] Syslog.global.certificate.strictX509Compliance not configured correctly (False)
192.168.100.45:   [PASS] DCUI.Access configured correctly (root)
192.168.100.45:   [PASS] Config.HostAgent.log.level configured correctly (info)
192.168.100.45:   [PASS] Net.DVFilterBindIpAddress configured correctly ()
192.168.100.45:   [FAIL] Syslog.global.auditRecord.storageDirectory not configured correctly ([] /scratch/auditLog)
192.168.100.45:   [FAIL] Syslog.global.logDir not configured correctly ([] /scratch/log)
192.168.100.45:   [FAIL] Syslog.global.logHost not configured correctly ()
192.168.100.45:   [FAIL] Annotations.WelcomeMessage not configured correctly ()
192.168.100.45:   [FAIL] Config.Etc.Issue not configured correctly ()
192.168.100.45:   [FAIL] DCUI user has shell access enabled (true)
192.168.100.45:   [PASS] Entropy sources configured correctly (FALSE, 0)
192.168.100.45:   [FAIL] Secure Boot enforcement is not enabled (false)
192.168.100.45:   [FAIL] TPM configuration encryption is not enabled (NONE)
192.168.100.45:   [PASS] Host Image Profile Acceptance Level is configured correctly (PartnerSupported)
192.168.100.45:   [PASS] Active Directory integration is configured correctly ()
192.168.100.45:   [PASS] SSH has FIPS mode enabled (true)
192.168.100.45:   [PASS] SSH ciphers configured correctly (aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr)
192.168.100.45:   [PASS] SSH gatewayports configured correctly (no)
192.168.100.45:   [PASS] SSH hostbasedauthentication configured correctly (no)
192.168.100.45:   [PASS] SSH clientalivecountmax configured correctly (3)
192.168.100.45:   [PASS] SSH clientaliveinterval configured correctly (200)
192.168.100.45:   [PASS] SSH banner configured correctly (/etc/issue)
192.168.100.45:   [PASS] SSH ignorerhosts configured correctly (yes)
192.168.100.45:   [PASS] SSH allowstreamlocalforwarding configured correctly (no)
192.168.100.45:   [PASS] SSH allowtcpforwarding configured correctly (no)
192.168.100.45:   [PASS] SSH permittunnel configured correctly (no)
192.168.100.45:   [PASS] SSH permituserenvironment configured correctly (no)
192.168.100.45:   [PASS] sfcbd-watchdog is not running (False)
192.168.100.45:   [FAIL] sfcbd-watchdog is configured to start (on)
192.168.100.45:   [FAIL] TSM is running (True)
192.168.100.45:   [FAIL] TSM is configured to start (on)
192.168.100.45:   [PASS] slpd is not running (False)
192.168.100.45:   [PASS] slpd is not configured to start (off)
192.168.100.45:   [PASS] snmpd is not running (False)
192.168.100.45:   [FAIL] snmpd is configured to start (on)
192.168.100.45:   [FAIL] TSM-SSH is running (True)
192.168.100.45:   [FAIL] TSM-SSH is configured to start (on)
192.168.100.45:   [FAIL] ntpd is running (False)
192.168.100.45:   [FAIL] ntpd is configured to start (off)
192.168.100.45:   [FAIL] NTP client not configured ()
192.168.100.45:   [FAIL] Lockdown Mode exception users not configured correctly ()
192.168.100.45:   [FAIL] Lockdown Mode is not configured correctly (lockdownDisabled)
192.168.100.45:   [PASS] Standard switch 'vSwitch0' is not configured to allow promiscuous mode (False)
192.168.100.45:   [PASS] Standard switch 'vSwitch0' is not configured to allow MAC address changes (False)
192.168.100.45:   [PASS] Standard switch 'vSwitch0' is not configured to allow forged transmits (False)
192.168.100.45:   [PASS] Standard portgroup 'Management Network' is not configured to allow promiscuous mode (False)
192.168.100.45:   [PASS] Standard portgroup 'Management Network' is not configured to allow MAC address changes (False)
192.168.100.45:   [PASS] Standard portgroup 'Management Network' is not configured to allow forged transmits (False)
192.168.100.45:   [PASS] Standard portgroup 'Management Network' is not configured to allow VLAN 4095 (0)
192.168.100.45:   [PASS] Standard portgroup 'Management Network' does not appear to be configured to use a default VLAN (0)
192.168.100.45:   [PASS] Standard portgroup 'VM Network' is not configured to allow promiscuous mode (False)
192.168.100.45:   [PASS] Standard portgroup 'VM Network' is not configured to allow MAC address changes (False)
192.168.100.45:   [PASS] Standard portgroup 'VM Network' is not configured to allow forged transmits (False)
192.168.100.45:   [PASS] Standard portgroup 'VM Network' is not configured to allow VLAN 4095 (0)
192.168.100.45:   [PASS] Standard portgroup 'VM Network' does not appear to be configured to use a default VLAN (0)
192.168.100.45:   [PASS] VMkernel NIC 'vmk0' has only management configured (ManagementTrafficEnabled: True, VMotionEnabled: False, FaultToleranceLoggingEnabled: False, VsanTrafficEnabled: False, ProvisioningEnabled: False, VSphereReplicationEnabled: False, VSphereReplicationNFCEnabled: False, VSphereBackupNFCEnabled: False)

vCLS-d50ef15f-7df6-4e94-8809-7afd00541836.txt

アプライアンス系は対象外みたいですね…(これは vCLS) 

vCLS-d50ef15f-7df6-4e94-8809-7afd00541836:   [INFO] Audit of vCLS-d50ef15f-7df6-4e94-8809-7afd00541836 started at 2023-10-30 20:11:36 from HAKUTAKA by mirie
vCLS-d50ef15f-7df6-4e94-8809-7afd00541836:   [INFO]
vCLS-d50ef15f-7df6-4e94-8809-7afd00541836:  [ERROR] VM may be a vSphere appliance. Altering VMware virtual appliances is not supported.


あまり細かくは見てないですが、ざっと見、チェック項目に対し PASS/FAIL でチェック結果を出力しているっぽい。 ただ、如何せん SCG の Excel シートとの紐づけられる情報が無いので網羅的にできてるのか/どれをチェックしたのか分かりにくい…

とりあえずチェックはできそうなので、見やすさは個々で工夫が必要。
今後の改善に期待したい。