6.0.3
Table Of Contents
- vSphere Security
- Contents
- About vSphere Security
- Updated Information
- Security in the vSphere Environment
- vSphere Authentication with vCenter Single Sign-On
- Understanding vCenter Single Sign-On
- How vCenter Single Sign-On Protects Your Environment
- vCenter Single Sign-On Components
- How vCenter Single Sign-On Affects Installation
- How vCenter Single Sign-On Affects Upgrades
- Using vCenter Single Sign-On with vSphere
- Groups in the vsphere.local Domain
- vCenter Server Password Requirements and Lockout Behavior
- Configuring vCenter Single Sign-On Identity Sources
- Identity Sources for vCenter Server with vCenter Single Sign-On
- Set the Default Domain for vCenter Single Sign-On
- Add a vCenter Single Sign-On Identity Source
- Edit a vCenter Single Sign-On Identity Source
- Remove a vCenter Single Sign-On Identity Source
- Use vCenter Single Sign-On with Windows Session Authentication
- vCenter Server Two-Factor Authentication
- Using vCenter Single Sign-On as the Identity Provider for Another Service Provider
- Managing the Security Token Service (STS)
- Managing vCenter Single Sign-On Policies
- Managing vCenter Single Sign-On Users and Groups
- Add vCenter Single Sign-On Users
- Disable and Enable vCenter Single Sign-On Users
- Delete a vCenter Single Sign-On User
- Edit a vCenter Single Sign-On User
- Add a vCenter Single Sign-On Group
- Add Members to a vCenter Single Sign-On Group
- Remove Members from a vCenter Single Sign-On Group
- Delete vCenter Single Sign-On Solution Users
- Change Your vCenter Single Sign-On Password
- vCenter Single Sign-On Security Best Practices
- Troubleshooting vCenter Single Sign-On
- Understanding vCenter Single Sign-On
- vSphere Security Certificates
- Certificate Management Overview
- Managing Certificates with the Platform Services Controller Web Interface
- Explore Certificate Stores from the Platform Services Controller Web Interface
- Replace Certificates with New VMCA-Signed Certificates from the Platform Services Controller Web Interface
- Make VMCA an Intermediate Certificate Authority from the Platform Services Controller Web Interface
- Set up Your System to Use Custom Certificates from the Platform Services Controller
- Managing Certificates with the vSphere Certificate Manager Utility
- Revert Last Performed Operation by Republishing Old Certificates
- Reset All Certificates
- Regenerate a New VMCA Root Certificate and Replace All Certificates
- Make VMCA an Intermediate Certificate Authority (Certificate Manager)
- Generate Certificate Signing Requests with vSphere Certificate Manager (Intermediate CA)
- Replace VMCA Root Certificate with Custom Signing Certificate and Replace All Certificates
- Replace Machine SSL Certificate with VMCA Certificate (Intermediate CA)
- Replace Solution User Certificates with VMCA Certificates (Intermediate CA)
- Replace All Certificates with Custom Certificate (Certificate Manager)
- Manual Certificate Replacement
- Managing Certificates and Services with CLI Commands
- View vCenter Certificates with the vSphere Web Client
- Set the Threshold for vCenter Certificate Expiration Warnings
- vSphere Permissions and User Management Tasks
- Understanding Authorization in vSphere
- Understanding the vCenter Server Permission Model
- Hierarchical Inheritance of Permissions
- Multiple Permission Settings
- Managing Permissions for vCenter Components
- Global Permissions
- Using Roles to Assign Privileges
- Best Practices for Roles and Permissions
- Required Privileges for Common Tasks
- Securing ESXi Hosts
- Use Scripts to Manage Host Configuration Settings
- Configure ESXi Hosts with Host Profiles
- General ESXi Security Recommendations
- Certificate Management for ESXi Hosts
- Host Upgrades and Certificates
- ESXi Certificate Default Settings
- View Certificate Expiration Information for Multiple ESXi Hosts
- View Certificate Details for a Single ESXi Host
- Renew or Refresh ESXi Certificates
- Change Certificate Default Settings
- Understanding Certificate Mode Switches
- Change the Certificate Mode
- Replacing ESXi SSL Certificates and Keys
- Use Custom Certificates with Auto Deploy
- Restore ESXi Certificate and Key Files
- Customizing Hosts with the Security Profile
- ESXi Firewall Configuration
- Customizing ESXi Services from the Security Profile
- Enable or Disable a Service in the Security Profile
- Lockdown Mode
- Check the Acceptance Levels of Hosts and VIBs
- Assigning Permissions for ESXi
- Using Active Directory to Manage ESXi Users
- Using vSphere Authentication Proxy
- Configuring Smart Card Authentication for ESXi
- ESXi SSH Keys
- Using the ESXi Shell
- Modifying ESXi Web Proxy Settings
- vSphere Auto Deploy Security Considerations
- Managing ESXi Log Files
- Securing vCenter Server Systems
- vCenter Server Security Best Practices
- Verify Thumbprints for Legacy ESXi Hosts
- Verify that SSL Certificate Validation Over Network File Copy Is Enabled
- vCenter Server TCP and UDP Ports
- Control CIM-Based Hardware Monitoring Tool Access
- Securing Virtual Machines
- Limit Informational Messages from Virtual Machines to VMX Files
- Prevent Virtual Disk Shrinking
- Virtual Machine Security Best Practices
- General Virtual Machine Protection
- Use Templates to Deploy Virtual Machines
- Minimize Use of Virtual Machine Console
- Prevent Virtual Machines from Taking Over Resources
- Disable Unnecessary Functions Inside Virtual Machines
- Remove Unnecessary Hardware Devices
- Disable Unused Display Features
- Disable Unexposed Features
- Disable HGFS File Transfers
- Disable Copy and Paste Operations Between Guest Operating System and Remote Console
- Limiting Exposure of Sensitive Data Copied to the Clipboard
- Restrict Users from Running Commands Within a Virtual Machine
- Prevent a Virtual Machine User or Process from Disconnecting Devices
- Modify Guest Operating System Variable Memory Limit
- Prevent Guest Operating System Processes from Sending Configuration Messages to the Host
- Avoid Using Independent Nonpersistent Disks
- Securing vSphere Networking
- Introduction to vSphere Network Security
- Securing the Network with Firewalls
- Secure the Physical Switch
- Securing Standard Switch Ports With Security Policies
- Securing vSphere Standard Switches
- Secure vSphere Distributed Switches and Distributed Port Groups
- Securing Virtual Machines with VLANs
- Creating a Network DMZ on a Single ESXi Host
- Creating Multiple Networks Within a Single ESXi Host
- Internet Protocol Security
- Ensure Proper SNMP Configuration
- Use Virtual Switches with the vSphere Network Appliance API Only If Required
- vSphere Networking Security Best Practices
- Best Practices Involving Multiple vSphere Components
- Synchronizing Clocks on the vSphere Network
- Storage Security Best Practices
- Verify That Sending Host Performance Data to Guests is Disabled
- Setting Timeouts for the ESXi Shell and vSphere Web Client
- Defined Privileges
- Alarms Privileges
- Auto Deploy and Image Profile Privileges
- Certificates Privileges
- Content Library Privileges
- Datacenter Privileges
- Datastore Privileges
- Datastore Cluster Privileges
- Distributed Switch Privileges
- ESX Agent Manager Privileges
- Extension Privileges
- Folder Privileges
- Global Privileges
- Host CIM Privileges
- Host Configuration Privileges
- Host Inventory
- Host Local Operations Privileges
- Host vSphere Replication Privileges
- Host Profile Privileges
- Inventory Service Provider Privileges
- Inventory Service Tagging Privileges
- Network Privileges
- Performance Privileges
- Permissions Privileges
- Profile-driven Storage Privileges
- Resource Privileges
- Scheduled Task Privileges
- Sessions Privileges
- Storage Views Privileges
- Tasks Privileges
- Transfer Service Privileges
- VRM Policy Privileges
- Virtual Machine Configuration Privileges
- Virtual Machine Guest Operations Privileges
- Virtual Machine Interaction Privileges
- Virtual Machine Inventory Privileges
- Virtual Machine Provisioning Privileges
- Virtual Machine Service Configuration Privileges
- Virtual Machine Snapshot Management Privileges
- Virtual Machine vSphere Replication Privileges
- dvPort Group Privileges
- vApp Privileges
- vServices Privileges
- Index
Option Description
--name <name>
Name of the solution user to create
--cert <cert file>
Path to the certicate le. This can be a certicate signed by
VMCA or a third-party certicate.
--login <admin_user_id>
By default, administrator@vsphere.local. That
administrator can add other users to the CAAdmins
vCenter Single Sign-On group to give them administrator
privileges.
--password <admin_password>
Password of the administrator user. If you do not specify
the password, you are prompted.
dir-cli service list
List the solution users that dir-cli knows about.
Option Description
--login <admin_user_id>
By default, administrator@vsphere.local. That
administrator can add other users to the CAAdmins
vCenter Single Sign-On group to give them administrator
privileges.
--password <admin_password>
Password of the administrator user. If you do not specify
the password, you are prompted.
dir-cli service delete
Delete a solution user in vmdir. When you delete the solution user, all associated services become
unavailable to all management nodes that use this instance of vmdir.
Option Description
--name
Name of the solution user to delete.
--login <admin_user_id>
By default, administrator@vsphere.local. That
administrator can add other users to the CAAdmins
vCenter Single Sign-On group to give them administrator
privileges.
--password <admin_password>
Password of the administrator user. If you do not specify
the password, you are prompted.
dir-cli service update
Updates the certicate for a specied solution user, that is, collection of services. After running this
command, VECS picks up the change after 5 minutes, or you can use vecs-cli force-refresh to force a
refresh.
Option Description
--name <name>
Name of the solution user to update .
--cert <cert_file>
Name of the certicate to assign to the service.
--login <admin_user_id>
By default, administrator@vsphere.local. That
administrator can add other users to the CAAdmins
vCenter Single Sign-On group to give them administrator
privileges.
--password <admin_password>
Password of the administrator user. If you do not specify
the password, you are prompted.
Chapter 3 vSphere Security Certificates
VMware, Inc. 129