6.0.3

Monitor configuration
files
Although most ESXi conguration seings are controlled with an API, a
limited number of conguration les aects the host directly. These les are
exposed through the vSphere le transfer API, which uses HTTPS. If you
make changes to these les, you must also perform the corresponding
administrative action such as making a conguration change.
N Do not aempt to monitor les that are NOT exposed via this le-
transfer API.
Use vmkfstools to erase
sensitive data
When you delete a VMDK le with sensitive data, shut down or stop the
virtual machine, and then issue the vCLI command vmkfstools --
writezeroes on that le. You can then delete the le from the datastore.
PCI and PCIe Devices and ESXi
Using the VMware DirectPath I/O feature to pass through a PCI or PCIe device to a virtual machine results
in a potential security vulnerability. The vulnerability can be triggered by buggy or malicious code, such as a
device driver, running in privileged mode in the guest OS. Industry-standard hardware and rmware does
not currently have sucient error containment support to make it possible for ESXi to fully close the
vulnerability.
VMware recommends that you use PCI or PCIe passthrough to a virtual machine only if the virtual machine
is owned and administered by a trusted entity. You must be sure that this entity does not to aempt to crash
or exploit the host from the virtual machine.
Your host might be compromised in one of the following ways.
n
The guest OS might generate an unrecoverable PCI or PCIe error. Such an error does not corrupt data,
but can crash the ESXi host. Such errors might occur because of bugs or incompatibilities in the
hardware devices that are being passed through, or because of problems with drivers in the guest OS.
n
The guest OS might generate a Direct Memory Access (DMA) operation that causes an IOMMU page
fault on the ESXi host, for example, if the DMA operation targets an address outside the virtual
machine's memory. On some machines, host rmware congures IOMMU faults to report a fatal error
through a non-maskable interrupt (NMI), which causes the ESXi host to crash. This problem might
occur because of problems with the drivers in the guest OS.
n
If the operating system on the ESXi host is not using interrupt remapping, the guest OS might inject a
spurious interrupt into the ESXi host on any vector. ESXi currently uses interrupt remapping on Intel
platforms where it is available; interrupt mapping is part of the Intel VT-d feature set. ESXi does not use
interrupt mapping on AMD platforms. A spurious interrupt most likely results in a crash of the ESXi
host; however, other ways to exploit these interrupts might exist in theory.
ESXi SSH Keys
You can use SSH keys to restrict, control, and secure access to an ESXi host. By using an SSH key, you can
allow trusted users or scripts to log in to a host without specifying a password.
You can copy the SSH key to the host by using the vifs vSphere CLI command. See Geing Started with
vSphere Command-Line Interfaces for information on installing and using the vSphere CLI command set. It is
also possible to use HTTPS PUT to copy the SSK key to the host.
Instead of generating the keys externally and uploading them, you can create the keys on the ESXi host and
download them. See VMware Knowledge Base article 1002866.
Chapter 5 Securing ESXi Hosts
VMware, Inc. 199