6.0.3

Securing ESXi Hosts 5
The ESXi hypervisor architecture has many built-in security features such as CPU isolation, memory
isolation, and device isolation. You can congure additional features such as lockdown mode, certicate
replacement, and smart card authentication for enhanced security.
An ESXi host is also protected with a rewall. You can open ports for incoming and outgoing trac as
needed, but should restrict access to services and ports. Using the ESXi lockdown mode and limiting access
to the ESXi Shell can further contribute to a more secure environment. Starting with vSphere 6.0, ESXi hosts
participate in the certicate infrastructure. Hosts are provisioned with certicate that are signed by the
VMware Certicate Authority (VMCA) by default.
See the VMware white paper Security of the VMware vSphere Hypervisor for additional information on ESXi
security.
This chapter includes the following topics:
n
“Use Scripts to Manage Host Conguration Seings,” on page 154
n
“Congure ESXi Hosts with Host Proles,” on page 155
n
“General ESXi Security Recommendations,” on page 156
n
“Certicate Management for ESXi Hosts,” on page 160
n
“Customizing Hosts with the Security Prole,” on page 173
n
“Assigning Permissions for ESXi,” on page 187
n
“Using Active Directory to Manage ESXi Users,” on page 189
n
“Using vSphere Authentication Proxy,” on page 192
n
“Conguring Smart Card Authentication for ESXi,” on page 196
n
“ESXi SSH Keys,” on page 199
n
“Using the ESXi Shell,” on page 201
n
“Modifying ESXi Web Proxy Seings,” on page 205
n
“vSphere Auto Deploy Security Considerations,” on page 206
n
“Managing ESXi Log Files,” on page 206
VMware, Inc.
153