5.8

Securing ESXi and the ESX Management Interfaces
Security of the ESXi management interface is critical to protect against unauthorized intrusion and misuse. If
a host is compromised in certain ways, the virtual machines it interacts with might also be compromised. To
minimize the risk of an attack through the management interface, ESXi is protected with a firewall.
To protect the host against unauthorized intrusion and misuse, VMware imposes constraints on several
parameters, settings, and activities. Constraints can be relaxed to meet configuration needs, but if done so,
measures have to be taken to protect the network as a whole and the devices connected to the host.
Consider the following recommendations when evaluating host security and administration.
n
To improve security, restrict user access to the management interface and enforce access security
policies like setting up password restrictions.
n
The ESXi Shell has privileged access to certain parts of the host. Therefore, provide only trusted users
with ESXi Shell login access.
n
When possible, run only the essential processes, services, and agents such as virus checkers, and virtual
machine backups.
n
When possible, use the vSphere Web Client or a third-party network management tool to administer
ESXi Server hosts instead of working though the command-line interface as the root user. The usage of
the vSphere Client enables limitations to the accounts with access to the ESXi Shell and one can safely
delegate responsibilities and set up roles that prevent administrators and users from using capabilities
they do not need.
The host runs a variety of third-party packages to support management interfaces or tasks that an operator
must perform. VMware does not support upgrading these packages from anything other than a VMware
source. If a download or patch is used from another source, management interface security or functions
might be compromised. Regularly check third-party vendor sites and the VMware knowledge base for
security alerts.
In addition to implementing the firewall, risks to the hosts are mitigated using other methods.
n
By default, all ports not specifically required for management access to the host are closed. Ports must
be specifically opened if additional services are required.
n
By default, weak ciphers are disabled and all communications from clients are secured by SSL. The
exact algorithms used for securing the channel depend on the SSL handshake. Default certificates
created on ESXi use SHA-1 with RSA encryption as the signature algorithm.
n
VMware monitors all security alerts that could affect ESXi security and, if needed, issues a security
patch.
n
Insecure services such as FTP and Telnet are not installed, and the ports for these services are closed by
default. Because more secure services such as SSH and SFTP are easily available, always avoid using
these insecure services in favor of their safer alternatives. If insecure services must be used sufficient
protection for the host must be implemented, specific ports must be opened to support these services.
To increase the security of the ESXi Server hosts, they can be put in lockdown mode. When lockdown mode
is enabled, no users other than vpxuser have authentication permissions, nor can they perform operations
against the host directly. Lockdown mode forces all operations to be performed through vCenter Server.
When a host is in lockdown mode, vSphere CLI commands cannot be executed from an administration
server, from a script, or from VMware vSphere Management Assistant against the host. External software or
management tools might not be able to retrieve or modify information from the ESXi host.
vCloud Suite Architecture Overview and Use Cases
38 VMware, Inc.