6.0

Securing Virtual Machines
The guest operating system that runs in the virtual machine is subject to the same security risks as a physical
system. Secure virtual machines as you would secure physical machines.
1 Prevent Virtual Disk Shrinking on page 63
Nonadministrative users in the guest operating system are able to shrink virtual disks. Shrinking a
virtual disk reclaims the disk's unused space. However, if you shrink a disk repeatedly, the disk can
become unavailable or cause a Denial of Service (DoS). To prevent this, disable the ability to shrink
virtual disks.
2 Disable Copy and Paste Operations Between Guest Operating System and Remote Console on
page 64
Copy and paste operations between the guest operating system and remote console are disabled by
default. For a secure environment, retain the default setting. If you require copy and paste operations,
you must enable them using the vSphere Client.
3 Modify Guest Operating System Variable Memory Limit on page 64
You can increase the guest operating system variable memory limit if large amounts of custom
information are being stored in the configuration file.
4 Prevent the Guest Operating System Processes from Sending Configuration Messages to the Host on
page 65
You can prevent guests from writing any name-value pairs to the configuration file that are sent to the
host. This is appropriate when guest operating systems must be prevented from modifying
configuration settings.
5 Prevent a Virtual Machine User or Process from Disconnecting Devices on page 65
Users and processes without root or administrator privileges within virtual machines have the
capability to connect or disconnect devices, such as network adaptors and CD-ROM drives, as well as
the ability to modify device settings. To increase virtual machine security, remove these devices. If you
do not want to permanently remove a device, you can prevent a virtual machine user or process from
connecting or disconnecting the device from within the guest operating system.
6 Configure Syslog on ESXi Hosts on page 66
All ESXi hosts run a syslog service (vmsyslogd), which logs messages from the VMkernel and other
system components to log files.
Prevent Virtual Disk Shrinking
Nonadministrative users in the guest operating system are able to shrink virtual disks. Shrinking a virtual
disk reclaims the disk's unused space. However, if you shrink a disk repeatedly, the disk can become
unavailable or cause a Denial of Service (DoS). To prevent this, disable the ability to shrink virtual disks.
Prerequisites
Turn off the virtual machine.
Procedure
1 Log in to the vCenter Server system using the vSphere Client.
2 Select the virtual machine in the inventory.
3 On the Summary tab, click Edit Settings.
4 Select Options > Advanced > General and click Configuration Parameters.
Chapter 6 Securing the Management Interface
VMware, Inc. 63