6.0.3

Minimize Access
Avoid allowing users to log directly in to the vCenter Server host machine. Users who are logged in to the
vCenter Server can potentially cause harm, either intentionally or unintentionally, by altering seings and
modifying processes. They also have potential access to vCenter credentials, such as the SSL certicate.
Allow only those users who have legitimate tasks to perform to log in to the system and ensure that login
events are audited.
Monitor Privileges of vCenter Server Administrator Users
Not all administrator users must have the Administrator role. Instead, create a custom role with the
appropriate set of privileges and assign it to other administrators.
Users with the vCenter Server Administrator role have privileges on all objects in the hierarchy. For
example, by default the Administrator role allows users to interact with les and programs inside a virtual
machine's guest operating system. Assigning that role to too many users can lessen virtual machine data
condentiality, availability, or integrity. Create a role that gives the administrators the privileges they need,
but remove some of the virtual machine management privileges.
Grant Minimal Privileges to vCenter Server Database Users
The database user requires only certain privileges specic to database access. In addition, some privileges
are required only for installation and upgrade. These privileges can be removed after the product is installed
or upgraded.
Restrict Datastore Browser Access
The datastore browser functionality allows users with proper privileges to view, upload, or download les
on datastores associated with the vSphere deployment through the Web browser or the vSphere Web Client.
Assign the Datastore.Browse datastore privilege only to users or groups who really need those privileges.
Restrict Users from Running Commands in a Virtual Machine
By default, a user with vCenter Server Administrator role can interact with les and programs within a
virtual machine's guest operating system. To reduce the risk of breaching guest condentiality, availability,
or integrity, create a nonguest access role without the Guest Operations privilege. See “Restrict Users from
Running Commands Within a Virtual Machine,” on page 224.
Verify Password Policy for vpxuser
By default, vCenter Server changes the vpxuser password automatically every 30 days. Ensure that this
seing meets your policies, or congure the policy to meet your company's password aging policies. See
“Set the vCenter Server Password Policy,” on page 211.
N Make sure that password aging policy is not too short.
Check Privileges after vCenter Server Restart
Check for privilege reassignment when you restart vCenter Server. If the user or user group that is assigned
the Administrator role on the root folder cannot be veried as a valid user or group during a restart, the role
is removed from that user or group. In its place, vCenter Server grants the Administrator role to the vCenter
Single Sign-On account [e-mail]. This account can then act as the administrator.
Reestablish a named administrator account and assign the Administrator role to that account to avoid using
the anonymous [e-mail] account.
vSphere Security
210 VMware, Inc.