6.0.3

Users who can access the ESXi host must have permissions to manage the
host. You set permissions on the host object from vCenter Server that
manages the host.
Use Named Users and
Least Privilege
Many tasks can be performed by the root user by default. Instead of allowing
administrators to log in to the ESXi host using the root user account, you can
apply dierent host conguration privileges to dierent named users from
the vCenter Server permissions management interface. You can create a
custom roles, assign privileges to the role, and associate the role with a
named user and an ESXi host object from the vSphere Web Client.
In a single host scenario, you manage users directly. See the vSphere
Administration with the vSphere Client documentation.
Minimize the Number of
Open ESXi Firewall
Ports
By default, rewall ports on your ESXi host are opened only when you start a
corresponding service. You can use the vSphere Web Client or ESXCLI or
PowerCLI commands to check and manage rewall port status.
See “ESXi Firewall Conguration,” on page 173.
Automate ESXi Host
Management
Because it is often important that dierent hosts in the same data center are
in sync, use scripted installation or vSphere Auto Deploy to provision hosts.
You can manage the hosts using scripts. An alternative to scripted
management are host proles. You set up a reference host, export the host
prole, and apply the host prole to your host. You can apply the host prole
directly or as part of provisioning with Auto Deploy.
See “Use Scripts to Manage Host Conguration Seings,” on page 154 and
see the vSphere Installation and Setup for information about vSphere Auto
Deploy.
Take Advantage of
Lockdown Mode
In lockdown mode, ESXi hosts can be accessed only through vCenter Server
by default. Starting with vSphere 6.0, you can select strict lockdown mode or
normal lockdown mode, and you can dene Exception Users to allow direct
access to service accounts such as backup agents.
See “Lockdown Mode,” on page 180.
Check VIB Package
Integrity
Each VIB package has an associated acceptance level. You can add a VIB to
an ESXi host only if the acceptance level is the same or beer than the
acceptance level of the host. You cannot add a CommunitySupported or
PartnerSupported VIB to a host unless you explicitly change the host's
acceptance level.
See “Check the Acceptance Levels of Hosts and VIBs,” on page 186.
Manage ESXi
Certificates
In vSphere 6.0 and later, the VMware Certicate Authority (VMCA)
provisions each ESXi host with a signed certicate that has VMCA as the root
certicate authority by default. If company policy requires it, you can replace
the existing certicates with certicates that are signed by a third-party CA.
See “Certicate Management for ESXi Hosts,” on page 160
Smart Card
Authentication
Starting with vSphere 6.0, ESXi supports smart card authentication as an
option instead of user name and password authentication.
vSphere Security
12 VMware, Inc.