# encoding: UTF-8

control 'ESXI-70-000042' do
  title 'The ESXi host must terminate shell services after ten minutes.'
  desc  "When the ESXi Shell or SSH services are enabled on a host they will
run indefinitely. To avoid having these services left running set the
ESXiShellTimeOut. The ESXiShellTimeOut defines a window of time after which the
ESXi Shell and SSH services will automatically be stopped."
  desc  'rationale', ''
  desc  'check', "
    From the vSphere Client go to Hosts and Clusters >> Select the ESXi Host >>
Configure >> System >> Advanced System Settings. Select the
\"UserVars.ESXiShellTimeOut\" value and verify it is set to \"600\" (10
minutes).

    or

    From a PowerCLI command prompt while connected to the ESXi host run the
following command:

    Get-VMHost | Get-AdvancedSetting -Name UserVars.ESXiShellTimeOut

    If the \"UserVars.ESXiShellTimeOut\" setting is not set to \"600\", this is
a finding.
  "
  desc  'fix', "
    From the vSphere Client go to Hosts and Clusters >> Select the ESXi Host >>
Configure >> System >> Advanced System Settings. Click \"Edit\". Select the
\"UserVars.ESXiShellTimeOut\" value and configure it to \"600\".

    or

    From a PowerCLI command prompt while connected to the ESXi host run the
following command(s):

    Get-VMHost | Get-AdvancedSetting -Name UserVars.ESXiShellTimeOut |
Set-AdvancedSetting -Value 600
  "
  impact 0.5
  tag severity: 'medium'
  tag gtitle: 'SRG-OS-000163-VMM-000700'
  tag gid: nil
  tag rid: nil
  tag stig_id: 'ESXI-70-000042'
  tag fix_id: nil
  tag cci: 'CCI-001133'
  tag nist: ['SC-10']

  command = "(Get-VMHost -Name #{input('vmhostName')}) | Get-AdvancedSetting -Name UserVars.ESXiShellTimeOut | Select-Object -ExpandProperty Value"
  describe powercli_command(command) do
    its ('stdout.strip') { should cmp "600" }
  end

end

