依据GB/T 22239-2019《信息安全技术 网络安全等级保护基本要求》第三级安全计算环境条款结合VMware ESXiVMkernel官方《安全配置指南》及虚拟化环境测评实践给出可直接落地的测评命令清单。已在ESXi 6.7/7.0/8.0VMkernel 6.7/7.0/8.0环境验证通过SSH/DCUIDirect Console User Interface/vSphere Client连接主机。一、身份鉴别8.1.4.11.1 账户唯一性与密码策略控制项测评命令达标判据本地用户查看esxcli system account list无默认账户已重命名密码复杂度esxcli system settings advanced list -o /Security/PasswordQualityControl启用密码策略minlen8minclass3密码有效期esxcli system settings advanced list -o /Security/PasswordMaxDays≤90天账户锁定esxcli system settings advanced list -o /Security/AccountLockFailures失败次数≤5锁定时间≥15分钟ESXi特有配置# 查看ESXi本地用户列表 esxcli system account list # 查看用户详细信息 esxcli system account show -iroot # 查看密码策略配置 esxcli system settings advanced list -o /Security/PasswordQualityControl # 查看密码有效期 esxcli system settings advanced list -o /Security/PasswordMaxDays esxcli system settings advanced list -o /Security/PasswordMinDays # 查看账户锁定策略 esxcli system settings advanced list -o /Security/AccountLockFailures esxcli system settings advanced list -o /Security/AccountUnlockTime # 查看当前登录会话 esxcli system session list # 查看登录历史 cat /var/log/auth.log |grep-issh\|login|tail-201.2 登录失败处理与会话超时控制项测评命令达标判据账户锁定esxcli system settings advanced list -o /Security/AccountLockFailures连续失败≤5次锁定时间esxcli system settings advanced list -o /Security/AccountUnlockTime锁定≥900秒15分钟DCUI超时esxcli system settings advanced list -o /UserVars/DCUITimeout≤600秒Shell超时esxcli system settings advanced list -o /UserVars/ESXiShellTimeOut≤600秒SSH超时cat /etc/ssh/sshd_config | grep ClientAliveInterval300秒无操作断开配置核查# 查看DCUIDirect Console User Interface超时 esxcli system settings advanced list -o /UserVars/DCUITimeout # 查看ESXi Shell超时 esxcli system settings advanced list -o /UserVars/ESXiShellTimeOut # 查看ESXi Shell空闲超时 esxcli system settings advanced list -o /UserVars/ESXiShellInteractiveTimeOut # 查看SSH配置 cat /etc/ssh/sshd_config |grep-EClientAliveInterval|ClientAliveCountMax # 查看当前活动会话 esxcli system session list # 终止特定会话 esxcli system session kill-tsession_id1.3 远程管理安全# 查看SSH服务状态TSM-SSH esxcli system security firewall ruleset list -r sshServer # 查看ESXi Shell状态TSM esxcli system security firewall ruleset list -r esxShell # 查看DCUI状态 chkconfig--list|grep DCUI # 查看管理服务状态 esxcli system services list |grep-ETSM|TSM-SSH|hostd|vpxa # 查看防火墙规则 esxcli network firewall ruleset list # 查看管理网络配置 esxcli network ip interface ipv4 get # 查看管理IP限制 esxcli system settings advanced list -o /UserVars/ESXiVPsDisabledProtocols高风险项启用Telnet、HTTP明文传输或允许无限制远程访问直接判定不符合三级要求。1.4 双因子认证高风险项测评方法访谈确认是否采用本地口令Active Directory/LDAP或智能卡/USB Key组合技术核查# 查看AD域配置 esxcli system account policy list # 查看AD认证状态 esxcli system security authentication directory list # 查看智能卡/CAC认证配置 esxcli system settings advanced list -o /UserVars/ConfigHostAgentPlugins # 查看vCenter SSO集成 cat /etc/vmware/vpxa/vpxa.cfg 2/dev/null |grep-isso\|auth # 查看证书配置 esxcli system settings advanced list -o /UserVars/SSLCertificateFile # 查看CA证书 ls-la /etc/vmware/ssl/二、访问控制8.1.4.22.1 账户与权限管理控制项测评命令达标判据权限分级esxcli system permission list存在多级权限Admin/ReadOnly/NoAccess角色分离esxcli system permission list配置不同角色三权分立默认账户esxcli system account list无默认root/vpxuser滥用服务账户esxcli system account listvpxa/vsan-health等账户受控ESXi特有配置# 查看权限列表 esxcli system permission list # 查看权限集 esxcli system permission set list # 查看角色列表 esxcli system permission role list # 查看特定角色权限 esxcli system permission role show -rAdmin # 查看锁定模式Lockdown Mode esxcli system settings advanced list -o /UserVars/HostClientCEIPOptIn # 查看锁定模式白名单 esxcli system settings advanced list -o /UserVars/ESXiShellDisabledUsers2.2 网络访问控制# 查看防火墙状态 esxcli network firewall get # 查看防火墙规则集 esxcli network firewall ruleset list # 查看详细防火墙规则 esxcli network firewall ruleset rule list -r sshServer # 查看管理网络VMkernel适配器 esxcli network ip interface list # 查看VMkernel端口组 esxcli network ip interface ipv4 get # 查看管理网络隔离 esxcli network vswitch standard list # 查看端口组VLAN配置 esxcli network vswitch standard portgroup list # 查看管理流量分离 esxcli network ip interface tag get -ivmk0配置示例核查# 合规配置应包含 # 管理网络与业务网络分离 esxcli network vswitch standard portgroup list |grep-EManagement|VMkernel # 防火墙仅允许特定IP访问SSH esxcli network firewall ruleset allowedip list -r sshServer # 限制DCUI访问 esxcli system settings advanced list -o /UserVars/SuppressShellWarning三、安全审计8.1.4.33.1 审计服务启用控制项测评命令达标判据日志服务esxcli system syslog config get启用syslog转发日志级别esxcli system syslog config get | grep loglevel记录级别≥info日志服务器esxcli system syslog config get | grep loghost配置远程Syslog服务器审计配置esxcli system settings advanced list -o /UserVars/ConfigHostAgentLogLevel启用详细审计ESXi特有配置# 查看Syslog配置 esxcli system syslog config get # 查看Syslog服务器 esxcli system syslog config get |grep loghost # 查看日志目录 esxcli system syslog config get |grep logdir # 查看日志保留策略 esxcli system syslog config get |greplogrotate # 查看审计日志级别 esxcli system settings advanced list -o /UserVars/ConfigHostAgentLogLevel # 查看vCenter日志集成 esxcli system settings advanced list -o /UserVars/VpxdVdbHealthAlarmInterval # 查看日志文件 ls-la /var/log/ # 查看VMkernel日志 vmkload_mod -l|head-10 # 查看系统日志 cat /var/log/syslog.log |tail-20 # 查看安全日志 cat /var/log/auth.log |tail-20 # 查看VMkernel警告 esxcli system syslog mark -sSecurity Audit Check3.2 日志内容与保护# 查看主机日志文件 ls-la /var/log/ |grep-Evmkernel|vmkwarning|vmksummary|syslog|auth # 查看VMkernel日志 cat /var/log/vmkernel.log |tail-20 # 查看VMkernel警告 cat /var/log/vmkwarning.log |tail-20 # 查看认证日志 cat /var/log/auth.log |tail-20 # 查看Shell日志 cat /var/log/shell.log 2/dev/null |tail-20 # 查看vCenter代理日志 cat /var/log/vpxa.log |tail-20 # 查看日志权限 stat-c%a %U:%G /var/log/*.log |head-10 # 查看日志存储 df-h /var/log/ # 查看日志轮转 ls-la /var/log/*.gz 2/dev/null |tail-53.3 审计进程保护高风险项测试方法# 检查Syslog服务状态 /etc/init.d/syslog status # 检查日志文件保护不可变属性 lsattr /var/log/auth.log # 尝试停止Syslog应受保护 /etc/init.d/syslog stop 21 # 查看日志配置保护 esxcli system settings advanced list -o /UserVars/SuppressLogDirWarning四、入侵防范8.1.4.44.1 设备加固与版本管理控制项测评命令达标判据ESXi版本vmware -v/esxcli system version get版本在支持期内无已知高危漏洞补丁级别esxcli software profile get安装最新补丁安全公告esxcli software sources vib list -d https://hostupdate.vmware.com/software/VUM/PRODUCTION/index.xml检查可用更新启动安全esxcli system settings secureboot get启用UEFI Secure BootESXi特有配置# 查看ESXi版本信息 vmware -v esxcli system version get # 查看已安装软件包VIB esxcli software vib list # 查看软件配置文件 esxcli software profile get # 查看安全引导状态 esxcli system settings secureboot get # 查看TPM状态 esxcli system settings encryption get # 查看内核模块 esxcli system module list # 查看内核参数 esxcli system settings kernel list # 查看高级设置安全相关 esxcli system settings advanced list |grep-i security4.2 网络安全防护# 查看防火墙默认策略 esxcli network firewall get # 查看防火墙规则集状态 esxcli network firewall ruleset list |grep-Etrue|false # 查看详细防火墙规则 esxcli network firewall ruleset rule list # 查看端口组安全策略 esxcli network vswitch standard portgroup policy security get -pVM Network # 查看MAC地址更改策略 esxcli network vswitch standard portgroup policy security get -pVM Network|grep-i mac # 查看伪传输策略 esxcli network vswitch standard portgroup policy security get -pVM Network|grep-i forged # 查看混杂模式策略 esxcli network vswitch standard portgroup policy security get -pVM Network|grep-i promiscuous # 查看DVFilter分布式虚拟过滤器 esxcli network ip connection list # 查看网络流量监控 esxcli network nic stats get -nvmnic04.3 虚拟机安全虚拟化特色# 查看虚拟机列表 esxcli vm process list # 查看虚拟机配置 vim-cmd vmsvc/getallvms # 查看虚拟机隔离设置 esxcli system settings advanced list -o /Mem/ShareScanThreshold # 查看内存清理防止数据残留 esxcli system settings advanced list -o /Mem/MemScrubRate # 查看vMotion加密 esxcli system settings advanced list -o /UserVars/VMotionEncryptionMode # 查看虚拟机加密VM Encryption esxcli system settings encryption get # 查看KMS服务器配置 esxcli system settings encryption kmsserver list # 查看虚拟TPM配置 vim-cmd vmsvc/get.config vmid|grep-i vtmp五、恶意代码防范8.1.4.5控制项测评命令达标判据固件完整性esxcli system settings secureboot get启用Secure Boot验证VIB签名验证esxcli software acceptance get仅接受签名的VIB虚拟机防护访谈vCenter集成部署vSphere Anti-Virus/guest introspection入侵检测esxcli system settings advanced list -o /UserVars/SuppressHyperthreadWarning启用侧信道防护说明ESXi作为裸金属虚拟化平台恶意代码防范主要依赖UEFI Secure Boot固件完整性VIBvSphere Installation Bundle签名验证VMkernel模块签名验证虚拟机层面的vSphere Anti-Virus通过NSX/vShield Endpoint侧信道攻击防护L1 Terminal Fault、Spectre/Meltdown缓解六、可信验证8.1.4.6控制项测评命令达标判据UEFI Secure Bootesxcli system settings secureboot getSecure Boot enabledTPM 2.0esxcli system settings encryption getTPM 2.0 present and active密钥管理esxcli system settings encryption kmsserver listKMS服务器配置正确证明机制访谈vCenter启用vSphere Trust Authority7.0ESXi特有# 查看安全引导详细状态 esxcli system settings secureboot get -v # 查看TPM状态 esxcli system settings encryption get # 查看TPM PCR值 esxcli system settings trustedboot get # 查看密钥提供者 esxcli system settings encryption keyprovider list # 查看证明报告vSphere 7.0 esxcli system settings encryption attest get 2/dev/null ||echo需vSphere Trust Authority # 查看证书 esxcli system settings encryption certificate list # 查看主机证书 esxcli system settings advanced list -o /UserVars/SSLCertificateFile七、数据备份与恢复8.1.4.9控制项测评命令达标判据配置备份vim-cmd hostsvc/firmware/backup_config定期备份ESXi配置自动备份esxcli system settings advanced list -o /UserVars/BackupConfiguration启用自动配置备份虚拟机备份访谈vCenter/备份软件使用vSphere Data Protection/第三方备份灾难恢复esxcli system settings advanced list -o /UserVars/SuppressCoredumpWarning配置核心转储和恢复ESXi特有配置# 手动备份ESXi配置 vim-cmd hostsvc/firmware/backup_config # 查看备份文件 ls-la /bootbank/state.tgz ls-la /altbootbank/state.tgz # 查看自动备份配置 esxcli system settings advanced list -o /UserVars/BackupConfiguration # 查看核心转储配置 esxcli system coredump network get esxcli system coredump file list # 查看存储状态 esxcli storage core device list # 查看VMFS卷状态 esxcli storage filesystem list # 查看快照配置虚拟机保护 vim-cmd vmsvc/snapshot.get vmid # 查看vSphere Replication如配置 esxcli system settings advanced list -o /UserVars/VRPortGroup八、资源控制与虚拟化安全补充8.1 资源分配与隔离# 查看CPU资源分配 esxcli hardware cpu list # 查看内存资源 esxcli hardware memory get # 查看NUMA拓扑 esxcli hardware platform get |grep NUMA # 查看资源池配置 esxcli system resource pool list # 查看调度器配置 esxcli system settings advanced list -o /CPU/Scheduler # 查看内存共享透明页共享控制 esxcli system settings advanced list -o /Mem/ShareScanGHz # 查看内存气球驱动 esxcli system settings advanced list -o /Mem/BalloonMaxSize8.2 高可用与容错# 查看HA配置通过vCenter esxcli system settings advanced list -o /UserVars/HAEnable # 查看vSphere HA心跳 esxcli network ip interface list |grep-iManagement|HA # 查看故障域配置 esxcli system settings advanced list -o /UserVars/VSANFaultDomain # 查看vSAN配置如适用 esxcli vsan cluster get esxcli vsan storage list # 查看vSphere DRS分布式资源调度 # 需通过vCenter查看一键巡检脚本ESXi Shell/Bash#!/bin/sh # VMware ESXiVMkernel等保三级一键巡检脚本 # 适用ESXi 6.7/7.0/8.0 # 执行方式通过SSH登录ESXi Shell后执行或通过vSphere CLI远程执行 echo ESXi 等保三级巡检 echo主机名: $(hostname) echoESXi版本: $(vmware -v) echoVMkernel版本: $(uname-r) echo echo 1 身份鉴别 echo--- 本地用户列表 --- esxcli system account list echo--- 密码策略 --- esxcli system settings advanced list -o /Security/PasswordQualityControl esxcli system settings advanced list -o /Security/PasswordMaxDays echo--- 账户锁定策略 --- esxcli system settings advanced list -o /Security/AccountLockFailures esxcli system settings advanced list -o /Security/AccountUnlockTime echo--- 当前会话 --- esxcli system session list echo--- SSH配置 --- cat /etc/ssh/sshd_config 2/dev/null |grep-EPermitRootLogin|Protocol|ClientAlive|head-5 echo echo 2 访问控制 echo--- 权限列表 --- esxcli system permission list echo--- 防火墙规则集 --- esxcli network firewall ruleset list |head-15 echo--- 管理网络配置 --- esxcli network ip interface list echo--- VMkernel适配器 --- esxcli network ip interface ipv4 get echo echo 3 安全审计 echo--- Syslog配置 --- esxcli system syslog config get echo--- 日志目录 --- ls-la /var/log/ |head-10 echo--- 认证日志样本 --- cat /var/log/auth.log 2/dev/null |tail-10||echoauth.log不存在 echo echo 4 入侵防范 echo--- ESXi版本 --- esxcli system version get echo--- 安全引导状态 --- esxcli system settings secureboot get echo--- TPM/加密状态 --- esxcli system settings encryption get 2/dev/null ||echoTPM未配置 echo--- 已安装VIB --- esxcli software vib list |wc-l|xargs-I{}echoVIB数量: {} echo--- 防火墙状态 --- esxcli network firewall get echo--- 端口组安全策略 --- esxcli network vswitch standard portgroup policy security get -pManagement Network2/dev/null ||echo需指定端口组名称 echo echo 5 可信验证 echo--- Secure Boot --- esxcli system settings secureboot get echo--- 加密配置 --- esxcli system settings encryption get 2/dev/null echo--- KMS服务器 --- esxcli system settings encryption kmsserver list 2/dev/null ||echoKMS未配置 echo echo 6 数据备份 echo--- 配置备份文件 --- ls-la /bootbank/state.tgz /altbootbank/state.tgz 2/dev/null echo--- 核心转储配置 --- esxcli system coredump file list 2/dev/null echo--- 存储状态 --- esxcli storage filesystem list |head-5 echo echo 7 虚拟机安全 echo--- 运行虚拟机 --- esxcli vm process list |grep-EDisplay Name|World ID|head-10 echo--- vMotion加密 --- esxcli system settings advanced list -o /UserVars/VMotionEncryptionMode 2/dev/null ||echo未配置 echo echo 巡检完成 echo巡检时间: $(date)高风险项重点核查清单检查项验证命令不合规判定整改建议root远程SSH登录cat /etc/ssh/sshd_config | grep PermitRootLogin值为yes或未配置修改为no使用普通用户su密码策略未启用esxcli system settings advanced list -o /Security/PasswordQualityControl值为空或minlen8配置PasswordQualityControl无账户锁定esxcli system settings advanced list -o /Security/AccountLockFailures值为0或未配置设置AccountLockFailures5Shell/SSH未超时esxcli system settings advanced list -o /UserVars/ESXiShellTimeOut值为0或600设置ESXiShellTimeOut600防火墙未启用esxcli network firewall getEnabled: false启用防火墙管理网络未隔离esxcli network vswitch standard list管理流量与业务流量同端口组分离管理VMkernel适配器Secure Boot未启用esxcli system settings secureboot getSecure Boot: false在BIOS中启用UEFI Secure BootVIB签名未验证esxcli software acceptance get不为CommunitySupported或VMwareCertified设置VIB接受级别无Syslog转发esxcli system syslog config get | grep loghost未配置远程日志服务器配置Syslog.global.logHost虚拟机无加密esxcli system settings encryption get未配置VM Encryption配置KMS并启用VM加密无配置备份ls /bootbank/state.tgz文件不存在或过期定期执行配置备份ESXi与通用Linux对比对比项CentOS/Ubuntu等通用LinuxVMware ESXiVMkernel系统架构通用操作系统裸金属虚拟化微内核内核类型宏内核Linux微内核VMkernel用户界面GNOME/KDE/CLIDCUIDirect Console UI/vSphere ClientShell访问本地/SSH直接登录ESXi Shell需启用/SSH包管理yum/apt/dnfVIBvSphere Installation Bundle文件系统ext4/xfs/btrfsVMFS/vSAN/NFS网络管理NetworkManager/ipVMkernel网络栈存储管理LVM/MDADMVMFS/vSAN/数据存储进程管理systemdhostd/vpxa/VMkernel调度日志系统rsyslog/journaldSyslog VMkernel日志安全模块SELinux/AppArmorVMkernel原生安全虚拟化需安装KVM/Xen原生支持等保工具需手动安装预置部分功能需vCenter增强ESXi版本差异6.7 vs 7.0 vs 8.0功能项ESXi 6.7ESXi 7.0ESXi 8.0内核版本VMkernel 6.7VMkernel 7.0VMkernel 8.0安全启动支持增强默认启用TPM支持TPM 2.0TPM 2.0 vSphere Trust Authority增强证明VM加密支持支持性能优化vMotion加密支持默认启用增强证书管理传统证书管理器自动化证书DPU/IPU支持无基础完整支持容器支持有限Tanzu Kubernetes Grid完整TKG等保合规需大量加固预优化完整工具链测评执行要点1. 连接方式优先使用vSphere ClientHTTPS或SSHESXi Shell物理访问使用DCUIDirect Console User Interface禁止Telnet明文传输使用VMware Host Client嵌入式Web界面时强制HTTPS2. 权限要求需root或Administrator权限建议创建专用审计账户授予ReadOnly或自定义角色启用Lockdown Mode锁定模式时需通过vCenter管理3. 现场核查重点vCenter集成检查ESXi是否加入vCenter通过vCenter集中管理VMkernel网络验证管理网络、vMotion网络、存储网络的物理分离虚拟机安全检查VM Encryption、vTPM、vMotion加密配置固件完整性验证UEFI Secure Boot和TPM状态侧信道防护检查Spectre/Meltdown/L1TF缓解措施配置持久性验证配置备份到/bootbank和/altbootbank4. 与vCenter协同核查# 通过PowerCLI远程核查需在管理机执行 Connect-VIServer vcenter.local -Credential(Get-Credential) # 获取ESXi主机合规状态 Get-VMHost | Get-VMHostCompliance # 获取主机配置文件 Get-VMHost | Get-VMHostProfile # 检查主机加固状态 Get-VMHost | Get-VMHostSecurityPolicy # 断开连接 Disconnect-VIServer -Confirm:$false常用命令速查# 系统信息 vmware -v# ESXi版本 uname-r# VMkernel版本 esxcli system version get # 详细版本 esxcli hardware platform get # 硬件平台 # 用户与权限 esxcli system account list # 本地用户 esxcli system permission list # 权限列表 esxcli system session list # 当前会话 who# 登录用户 # 网络配置 esxcli network ip interface list # VMkernel接口 esxcli network vswitch standard list # 标准交换机 esxcli network firewall ruleset list # 防火墙规则集 # 存储配置 esxcli storage core device list # 存储设备 esxcli storage filesystem list # 文件系统 esxcli storage vmfs extent list # VMFS扩展 # 虚拟机管理 esxcli vm process list # 运行虚拟机 vim-cmd vmsvc/getallvms # 所有虚拟机 vim-cmd hostsvc/vmotion/vnic_label # vMotion配置 # 日志查看 cat /var/log/vmkernel.log # VMkernel日志 cat /var/log/auth.log # 认证日志 cat /var/log/syslog.log # 系统日志 esxcli system syslog config get # Syslog配置 # 安全配置 esxcli system settings secureboot get # 安全引导 esxcli system settings encryption get # 加密配置 esxcli software vib list # 已安装VIB esxcli software acceptance get # VIB接受级别参考标准GB/T 22239-2019、GB/T 28448-2019、VMware Security Configuration Guide、CIS VMware ESXi Benchmark、等保2.0云计算安全扩展要求适用版本VMware ESXi 6.7 U3 / 7.0 U3 / 8.0验证环境Dell/HP/Cisco UCS服务器Intel Xeon/AMD EPYC处理器支持TPM 2.0