6.0.3

ESXi Networking Security Recommendations
Isolation of network trac is essential to a secure ESXi environment. Dierent networks require dierent
access and level of isolation.
Your ESXi host uses several networks. Use appropriate security measures for each network, and isolate
trac for specic applications and functions. For example, ensure that vSphere vMotion trac does not
travel over networks where virtual machines are located. Isolation prevents snooping. Having separate
networks also is recommended for performance reasons.
n
vSphere infrastructure networks are used for features such as VMware vSphere vMotion
®
, VMware
vSphere Fault Tolerance, and storage. These networks are considered to be isolated for their specic
functions and often are not routed outside a single physical set of server racks.
n
A management network isolates client trac, command-line interface (CLI) or API trac, and third-
party software trac from normal trac. This network should be accessible only by system, network,
and security administrators. Use jump box or virtual private network (VPN) to secure access to the
management network. Strictly control access within this network to potential sources of malware.
n
Virtual machine trac can ow over one or many networks. You can enhance the isolation of virtual
machines by using virtual rewall solutions that set rewall rules at the virtual network controller.
These seings travel with a virtual machine as it migrates from host to host within your vSphere
environment.
Disable the Managed Object Browser (MOB)
The managed object browser provides a way to explore the VMkernel object model. However, aackers can
use this interface to perform malicious conguration changes or actions because ou can change the host
conguration by using the managed object browser. Use the Managed Object Browser only for debugging,
and ensure that it is disabled in production systems.
Starting with vSphere 6.0, the MOB is disabled by default. However, for certain tasks, for example when
extracting the old certicate from a system, you have to use the MOB.
Procedure
1 Select the host in the vSphere Web Client and go to Advanced System .
2 Check the value of , and change it as appropriate.
Using vim-cmd from the ESXi Shell is no longer recommended.
Disable Authorized (SSH) Keys
Authorized keys allow you to enable access to an ESXi host through SSH without requiring user
authentication. To increase host security, do not allow users to access a host using authorized keys.
A user is considered trusted if their public key is in the /etc/ssh/keys-root/authorized_keys le on a host.
Trusted remote users are allowed to access the host without providing a password.
Procedure
n
For day-to-day operations, disable SSH on ESXi hosts.
n
If SSH is enabled, even temporarily, monitor the contents of the /etc/ssh/keys-root/authorized_keys
le to ensure that no users are allowed to access the host without proper authentication.
n
Monitor the /etc/ssh/keys-root/authorized_keys le to verify that it is empty and no SSH keys have
been added to the le.
n
If you nd that the /etc/ssh/keys-root/authorized_keys le is not empty, remove any keys.
Chapter 5 Securing ESXi Hosts
VMware, Inc. 159