6.0.3

See “Synchronizing Clocks on the vSphere Network,” on page 247.
Securing Virtual Machines
To secure your virtual machines, keep the guest operating systems patched and protect your environment
just as you would protect a physical machine. Consider disabling unnecessary functionality, minimize the
use of the virtual machine console, and follow other best practices.
Protect the Guest
Operating System
To protect your guest operating system, make sure that it uses the most
recent patches and, if appropriate, anti-spyware and anti-malware programs.
See the documentation from your guest operating system vendor and,
potentially, other information available in books or on the Internet.
Disable Unnecessary
Functionality
Check that unnecessary functionality is disabled to minimize potential points
of aack. Many of the features that are used infrequently are disabled by
default. Remove unnecessary hardware and disable certain features such as
HFSG or copy and paste between the virtual machine and a remote console.
See “Disable Unnecessary Functions Inside Virtual Machines,” on page 221.
Use Templates and
Scripted Management
Virtual machine templates allow you to set up the operating system so it
meets your requirements, and to then create additional virtual machines with
the same seings.
If you want to change seings after initial deployment, consider using
scripts, for example, PowerCLI. This documentation explains many tasks by
using the vSphere Web Client to beer illustrate the process, but scripts help
you keep your environment consistent. In large environments, you can group
virtual machines into folders to optimize scripting.
See “Use Templates to Deploy Virtual Machines,” on page 219. See vSphere
Virtual Machine Administration for details.
Minimize Use of the
Virtual Machine Console
The virtual machine console provides the same function for a virtual
machine that a monitor on a physical server provides. Users with access to
the virtual machine console have access to virtual machine power
management and removable device connectivity controls, which might allow
a malicious aack on a virtual machine.
Securing the Virtual Networking Layer
The virtual networking layer includes virtual network adapters, virtual switches, distributed virtual
switches, and ports and port groups. ESXi relies on the virtual networking layer to support communications
between virtual machines and their users. In addition, ESXi uses the virtual networking layer to
communicate with iSCSI SANs, NAS storage, and so forth.
vSphere includes the full array of features necessary for a secure networking infrastructure. You can secure
each element of the infrastructure, such as virtual switches, distributed virtual switches, virtual network
adapters, and so on separately. In addition, consider the following guidelines, discussed in more detail in
Chapter 8, “Securing vSphere Networking,” on page 227.
Isolate Network Traffic
Isolation of network trac is essential to a secure ESXi environment.
Dierent networks require dierent access and level of isolation. A
management network isolates client trac, command-line interface (CLI) or
API trac, and third-party software trac from normal trac. This network
should be accessible only by system, network, and security administrators.
vSphere Security
14 VMware, Inc.