September 2012

Security Considerations for
Configuring VMware Tools 6
Some VMware Tools settings might expose security risks. For example, VMware Tools enables you to connect
virtual devices such as serial and parallel ports to virtual machines. A connected device could be a potential
channel of attack. To harden a virtual machine and reduce security risks as much as possible, disable the
VMware Tools features that might be vulnerable to security threats.
For complete information about securely deploying VMware vSphere in a production environment, including
security recommendations for hosts, virtual machines, management components, and a networking
infrastructure, see the vSphere Hardening Guide. VMware Tools settings relate only to the virtual machine aspect
of a deployment.
Virtual machines are encapsulated in a small number of files. One of the important files is the configuration
file (.vmx file). This file governs the performance of the virtual hardware and other settings. You can use several
methods to see and modify the configuration settings:
n
Open the .vmx file directly in a text editor.
n
Use the vSphere Client to edit virtual machine settings. In the vSphere Client, editing these configuration
parameters is an advanced option in the virtual machine Edit Settings dialog box.
n
Use the vSphere Web Client to edit virtual machine settings. In the vSphere Web Client, editing these
configuration parameters is an advanced option in the virtual machine Edit Settings dialog box.
n
Use a vSphere API-based tool, such as Power CLI, to view and modify .vmx parameters.
After you edit a setting, the change does not take effect until you restart the virtual machine.
Review the following list of potential security threats and the corresponding VMware Tools parameters to set
in the virtual machine's .vmx file. The defaults for many of these parameters are already set to protect virtual
machines from these threats.
VMware, Inc.
45