Installation guide

Use Integrated Windows Authentication (IWA) with this directory by setting the IIS metabase property
NTAuthenticationProviders to the string 'Negotiate,NTML', which is the default value. As a VCM
administrator, set this value at the /VCM virtual directory to prevent subsequent modifications to the IIS
metabase from unintentionally overriding the default value.
Instructions to set the metabase property are in a Microsoft knowledge base article about how to configure
IIS to support both the Kerberos protocol and the NTLM protocol for network authentication.
Using HTTPS
HTTPS provides security against snooping and insures connection to a legitimate, not spoof, instance of
VCM.
Do not use plain HTTP for the VCM user interface because sensitive collection results, configuration data,
and configured passwords travel across the network. As a VCM administrator, set the VCM site root to
require HTTPS by following the directions described in a Microsoft knowledge base article about how to set
up an HTTPS service in IIS.
An HTTPS connection activates security precautions built into Internet Explorer when HTTPS is used in
combination with Internet Explorer secure configuration recommendations from Microsoft.
Also set SQL Server Reporting Services (SSRS) reports to use HTTPS, as described in the VCM Installation
Guide.
Web Server Certificates
When VCM uses SSL, TLS, or HTTPS, it authenticates the Web server and user interface client using
certificates issued by certificate authorities (CAs). These CAs must be internal, customer CAs or members
of the Microsoft Root Certificate Program as listed on the Microsoft Web site.
Mutual Authentication
Configure IIS to require client side certificates for mutual authentication from the VCM user interface
system. Client side certificates enhance security for the following reasons:
n
They approximate two-factor authentication.
n
They provide better assurance that the VCM user interface is being run from a trusted machine and
not, for example, from a kiosk.
n
They are required by some organizational security policies. For example, U.S. DoD client PKI initiatives
require client side certificates that are issued by DoD certification authorities.
VCM Security Guide
32
VMware, Inc.