6.0.3

Table 6‑1. vCenter Server TCP and UDP Ports (Continued)
Port Purpose
15007 vService Manager (VSM). This service registers vCenter Server extensions. Open this port only if
required by extensions that you intend to use.
50100-60099 The Client Integration Plug-in uses a local loopback hostname, and uses port 8093 and random
ports in the range 50100 to 60099. The Client Integration Plug-in uses this port range only for local
communication. The port can remain blocked by the rewall.
In addition to these ports, you can congure other ports depending on your needs.
Control CIM-Based Hardware Monitoring Tool Access
The Common Information Model (CIM) system provides an interface that enables hardware-level
management from remote applications using a set of standard APIs. To ensure that the CIM interface is
secure, provide only the minimum access necessary to these applications. If an application has been
provisioned with a root or full administrator account and the application is compromised, the full virtual
environment might be compromised.
CIM is an open standard that denes a framework for agent-less, standards-based monitoring of hardware
resources for ESXi. This framework consists of a CIM object manager, often called a CIM broker, and a set of
CIM providers.
CIM providers are used as the mechanism to provide management access to device drivers and underlying
hardware. Hardware vendors, including server manufacturers and specic hardware device vendors, can
write providers to provide monitoring and management of their particular devices. VMware also writes
providers that implement monitoring of server hardware, ESXi storage infrastructure, and virtualization-
specic resources. These providers run inside the ESXi system and therefore are designed to be extremely
lightweight and focused on specic management tasks. The CIM broker takes information from all CIM
providers, and presents it to the outside world via standard APIs, the most common one being WS-MAN.
Do not provide root credentials to remote applications to access the CIM interface. Instead, create a service
account specic to these applications and grant read-only access to CIM information to any local account
dened on the ESXi system, as well as any role dened in vCenter Server.
Procedure
1 Create a service account specic to CIM applications.
2 Grant read-only access to CIM information to any local account dened on the ESXi system, as well as
any role dened in vCenter Server.
3 (Optional) If the application requires write access to the CIM interface, create a role to apply to the
service account with only two privileges:
n
Host..SystemManagement
n
Host.CIM.CIMInteraction
This role can be local to the host or centrally dened on vCenter Server, depending on how the
monitoring application works.
When a user logs into the host with the service account you created for CIM applications, the user has only
the privileges SystemManagement and CIMInteraction, or read-only access.
vSphere Security
216 VMware, Inc.