6.0.3

-----BEGIN CERTIFICATE-----
previous cert
-----END CERTIFICATE-----
2 Copy the text starting with -----BEGIN PRIVATE KEY----- and ending with -----END PRIVATE KEY-----
into the /etc/vmware/ssl/rui.key le.
Include -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY-----.
3 Copy the text between -----BEGIN CERTIFICATE----- and -----END CERTIFICATE----- into
the /etc/vmware/ssl/rui.crt le.
Include -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----.
4 Restart the host or send ssl_reset events to all services that use the keys.
for s in /etc/init.d/*; do $s | grep ssl_reset > /dev/null; if [ $? == 0 ]; then $s
ssl_reset; fi; done
Customizing Hosts with the Security Profile
You can customize many of the essential security seings for your host through the Security Prole panel
available in the vSphere Web Client. The Security Prole is especially useful for single host management. If
you are managing multiple hosts, consider using one of the CLIs or SDKs and automating the
customization.
ESXi Firewall Configuration
ESXi includes a rewall that is enabled by default.
At installation time, the ESXi rewall is congured to block incoming and outgoing trac, except trac for
services that are enabled in the host's security prole.
As you open ports on the rewall, consider that unrestricted access to services running on an ESXi host can
expose a host to outside aacks and unauthorized access. Reduce the risk by conguring the ESXi rewall to
allow access only from authorized networks.
N The rewall also allows Internet Control Message Protocol (ICMP) pings and communication with
DHCP and DNS (UDP only) clients.
You can manage ESXi rewall ports as follows:
n
Use the security prole for each host in the vSphere Web Client. See “Manage ESXi Firewall Seings,”
on page 174
n
Use ESXCLI commands from the command line or in scripts. See “ESXi ESXCLI Firewall Commands,”
on page 178.
n
Use a custom VIB if the port you want to open is not included in the security prole.
You create custom VIBs with the vibauthor tool available from VMware Labs. To install the custom VIB,
you have to change the acceptance level of the ESXi host to CommunitySupported. See VMware
Knowledge Base Article 2007381.
N If you engage VMware Technical Support to investigate a problem on an ESXi host with a
CommunitySupported VIB installed, VMware Support might request that this CommunitySupported
VIB be uninstalled as a troubleshooting step to determine if that VIB is related to the problem being
investigated.
Chapter 5 Securing ESXi Hosts
VMware, Inc. 173