Privileges for Scanning ESXi Hosts

Support is added for scanning ESXi hosts using ESXi or vCenter credentials. For such scans, the authenticator sends a request to the ESXi host and then scans it using the vCenter credentials. This involves authenticating with vCenter, identifying specific ESXi hosts, and performing a compliance scan against this particular host. For an indirect scan, the privileges required by the user performing the scan are different from those required for a direct scan of the ESXi host.

Minimum privileges required for scanning ESXi hosts using ESXi credentials

To successfully authenticate and audit each ESXi host, a vCenter credential with read-only access to the ESXi host is required. However, there are some special Controls such as CID 9393, 9394, and 9012, that need extra privileges. These extra privileges are required to read VIBs and Kernel modules.

To create the scan user account that can cover all ESXi CIDs in PC library:

1. Create a role with read-only access and assign the Global.Settings and Host.Config.Change settings privilege for the role.
   1. Expand Global and select Settings.  (Affect CID 1129 6094 6097 9393 9394 17320)
   2. Expand Host > Configuration and select Change settings. (Affect CID 9012)
   3. Expand Permissions and select Modify permission. (Affect CID 8972 on ESXi 6.x)
   4. Expand Certificates > Manage Certificates (Affect CID 23394)
   5. Expand Host > Config and select Image. (Affect CID 23394 on ESXi 7.x and ESXi 8.x)
2. Add the scan user account with the following role privilege:

Specific privileges required for scanning user accounts are as follows:

Testing specific privileges using commands:

Minimal privileges of scanning ESXi hosts by using vCenter credentials

To successfully authenticate and audit each ESXi host, a vCenter credential with read-only access to the ESXi host is required. However, there are some special Controls such as CID 9393, 9394, and 9012, that need extra privileges. These extra privileges are required to read VIBs and Kernel modules.

To create the scan user account that could cover all ESXi CIDs in PC library:

1. Create a role with read-only access and assign the Global.Settings and Host.Config.Change settings privilege for the role.
   1. Expand Global and select Settings.  (Affect CID 9393 9349 17320)
   2. Expand Certificates > Manage Certificates (Affect CID 23394)
   3. Expand Host > Configuration and select Change settings (Affect CID 9012)
2. Add the scan user account with this role privilege.

Note: For CID 8972, the status of the users with shell access on the host 807339 (ML-11758) is not supported by VMware indirect scan.