VMware vSphere 7.0 ESXi Security Technical Implementation Guide

The VMware vSphere 7.0 ESXi Security Technical Implementation Guide (V1 R5) has 75 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

75STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V1 · R5

CurrentPublished Wed Sep 30 2026

The ESXi host Secure Shell (SSH) daemon must not allow compression or must only allow compression after successful authentication.

VMware vSphere 7.0 ESXi Security Technical Implementation Guide

Assessment Title

Rule Text

The ESXi host Secure Shell (SSH) daemon must not allow compression or must only allow compression after successful authentication.

Description

Discussion Text

If compression is allowed in an SSH connection prior to authentication, vulnerabilities in the compression software could result in compromise of the system from an unauthenticated connection, potentially with root privileges.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-256390

Rule

SV-256390r1272795_rule

Severity

medium

Rule Version

ESXI-70-000021

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

From an ESXi shell, run the following command:

# /usr/lib/vmware/openssh/bin/sshd -T|grep compression

Expected result:

compression no

If the output does not match the expected result, this is a finding.

Implementation Procedure

Fix Text

From an ESXi shell, add or correct the following line in "/etc/ssh/sshd_config":

Compression no

STIG check 16 of 75 in the VMware vSphere 7.0 ESXi STIG checklist

← Previous · V-256389The ESXi host Secure Shell (SSH) daemon must perform strict mode checking of home directory configuration files.Next · V-256391 →The ESXi host Secure Shell (SSH) daemon must be configured to not allow gateway ports.