6.0.3

Procedure
u
Provide templates for virtual machine creation that contain hardened, patched, and properly
congured operating system deployments.
If possible, deploy applications in templates as well. Ensure that the applications do not depend on
information specic to the virtual machine to be deployed.
What to do next
For more information about templates, see the vSphere Virtual Machine Administration documentation.
Minimize Use of Virtual Machine Console
The virtual machine console provides the same function for a virtual machine that a monitor on a physical
server provides. Users with access to the virtual machine console have access to virtual machine power
management and removable device connectivity controls, which might allow a malicious aack on a virtual
machine.
Procedure
1 Use native remote management services, such as terminal services and SSH, to interact with virtual
machines.
Grant access to the virtual machine console only when necessary.
2 Limit the connections to the console to as few connections as necessary.
For example, in a highly secure environment, limit the connection to one. In some environments, you
can increase that limit depending on how many concurrent connections are necessary to accomplish
normal tasks.
Prevent Virtual Machines from Taking Over Resources
When one virtual machine consumes so much of the host resources that other virtual machines on the host
cannot perform their intended functions, a Denial of Service (DoS) might occur. To prevent a virtual
machine from causing a DoS, use host resource management features such as seing Shares and using
resource pools.
By default, all virtual machines on an ESXi host share resources equally. You can use Shares and resource
pools to prevent a denial of service aack that causes one virtual machine to consume so much of the host’s
resources that other virtual machines on the same host cannot perform their intended functions.
Do not use Limits unless you fully understand the impact.
Procedure
1 Provision each virtual machine with just enough resources (CPU and memory) to function properly.
2 Use Shares to guarantee resources to critical virtual machines.
3 Group virtual machines with similar requirements into resource pools.
4 In each resource pool, leave Shares set to the default to ensure that each virtual machine in the pool
receives approximately the same resource priority.
With this seing, a single virtual machine cannot use more than other virtual machines in the resource
pool.
What to do next
See the vSphere Resource Management documentation for information about shares and limits.
vSphere Security
220 VMware, Inc.