VMware View Security View 5.0 View Manager 5.0 View Composer 2.7 This document supports the version of each product listed and supports all subsequent versions until the document is replaced by a new edition. To check for more recent editions of this document, see http://www.vmware.com/support/pubs.
VMware View Security You can find the most up-to-date technical documentation on the VMware Web site at: http://www.vmware.com/support/ The VMware Web site also provides the latest product updates. If you have comments about this documentation, submit your feedback to: docfeedback@vmware.com Copyright © 2011 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at http://www.
Contents VMware View Security 5 VMware View Security Reference 7 VMware View Accounts 8 VMware View Security Settings 9 VMware View Resources 17 VMware View Log Files 17 VMware View TCP and UDP Ports 19 Services on a View Connection Server Host 23 Services on a Security Server 24 Services on a View Transfer Server Host 24 Index 25 VMware, Inc.
VMware View Security 4 VMware, Inc.
VMware View Security VMware View Security provides a concise reference to the security features of VMware View™. n Required system and database login accounts. n Configuration options and settings that have security implications. n Resources that must be protected, such as security-relevant configuration files and passwords, and the recommended access controls for secure operation. n Location of log files and their purpose.
VMware View Security 6 VMware, Inc.
VMware View Security Reference When you are configuring a secure View environment, you can change settings and make adjustments in several areas to protect your systems. n VMware View Accounts on page 8 You must set up system and database accounts to administer VMware View components. n VMware View Security Settings on page 9 VMware View includes several settings that you can use to adjust the security of the configuration.
VMware View Security VMware View Accounts You must set up system and database accounts to administer VMware View components. Table 1. VMware View System Accounts VMware View Component Required Accounts View Client Configure user accounts in Active Directory for the users who have access to View desktops. The user accounts must be members of the Remote Desktop Users group, but the accounts do not require View administrator privileges.
VMware View Security Reference VMware View Security Settings VMware View includes several settings that you can use to adjust the security of the configuration. You can access the settings by using View Administrator, by editing group profiles, or by using the ADSI Edit utility, as appropriate. Security-Related Global Settings in View Administrator Security-related global settings for client sessions and connections are accessible under View Configuration > Global Settings in View Administrator. Table 3.
VMware View Security Table 4. Security-Related Server Settings Setting Description Connect using SSL If enabled, View communicates with a vCenter Server using SSL encryption. This setting is enabled by default. Use PCoIP Secure Gateway for PCoIP connections to desktop If enabled, View Client makes a further secure connection to the View Connection Server or security server host when users connect to a View desktop with the PCoIP display protocol.
VMware View Security Reference Table 5. Security-Related Settings in the View Agent Configuration Template Setting Registry Value Name AllowDirectRDP AllowDirectRDP Determines whether non-View clients can connect directly to View desktops with RDP. When this setting is disabled, View Agent permits only View-managed connections through View Client. IMPORTANT For View to operate correctly, the Windows Terminal Services service must be running on the guest operating system of each desktop.
VMware View Security Table 6. Security Settings in the View Client Configuration Template Setting Registry Value Name Description Allow command line credentials AllowCmdLineCreden tials Determines whether user credentials can be provided with View Client command line options. If this setting is enabled, the smartCardPIN and password options are not available when users run View Client from the command line. This setting is enabled by default.
VMware View Security Reference Table 6. Security Settings in the View Client Configuration Template (Continued) Setting Registry Value Name Description Certificate verification mode CertCheckMode Configures the level of certificate checking that is performed by View Client. You can select one of these modes: n No Security. View does not perform certificate checking. n Warn But Allow.
VMware View Security Table 6. Security Settings in the View Client Configuration Template (Continued) Setting Registry Value Name Description Default value of the 'Log in as current user' checkbox LogInAsCurrentUse Specifies the default value of the Log in as current user check box on the View Client connection dialog box. This setting overrides the default value specified during View Client installation.
VMware View Security Reference Table 6. Security Settings in the View Client Configuration Template (Continued) Setting Registry Value Name Description Ignore certificate revocation problems IgnoreRevocation Determines whether errors that are associated with a revoked server certificate are ignored. These errors occur when the server sends a certificate that has been revoked and when the client cannot verify a certificate's revocation status. This setting is disabled by default.
VMware View Security Table 7. Security-Related Settings in the Scripting Definitions Section Setting Registry Value Name Description Connect all USB devices to the desktop on launch connectUSBOnStartu p Determines whether all of the available USB devices on the client system are connected to the desktop when the desktop is launched. This setting is disabled by default.
VMware View Security Reference VMware View Resources VMware View includes several configuration files and similar resources that must be protected. Table 9. View Connection Server and Security Server Resources Resource Location Protection LDAP settings Not applicable. LDAP data is protected automatically as part of rolebased access control. LDAP backup files :\Programdata\VMWare\VDM\backups (Windows Server 2008) :\Documents and Settings\All Users\Application Data\VMWare\V
VMware View Security Table 11. VMware View Log Files VMware View Component File Path and Other Information All components (installation logs) %TEMP%\vminst.log_date_timestamp %TEMP%\vmmsi.log_date_timestamp View Agent Windows XP guest OS: :\Documents and Settings\All Users\Application Data\VMware\VDM\logs Windows Vista and Windows 7 guest OS: :\ProgramData\VMware\VDM\logs If a User Data Disk (UDD) is configured, might correspond to the UDD.
VMware View Security Reference VMware View TCP and UDP Ports View uses TCP and UDP ports for network access between its components. You might have to reconfigure a firewall to allow access on the appropriate ports. Table 12. TCP and UDP Ports Used by View, Excluding Local Mode Source Port Target Port Protocol Description Security server 4172 View Agent 4.5 or earlier 50002 (can be changed by group policy) UDP PCoIP (AES-128-GCM only) if PCoIP Secure Gateway is used.
VMware View Security Table 12. TCP and UDP Ports Used by View, Excluding Local Mode (Continued) 20 Source Port Target Port Protocol Description View Client * View Connection Server or security server 80 TCP HTTP access if SSL is disabled for client connections. View Client * View Connection Server or security server 443 TCP HTTPS access if SSL is enabled for client connections.
VMware View Security Reference Table 12. TCP and UDP Ports Used by View, Excluding Local Mode (Continued) Source Port Target Port Protocol Description View Client 4.6 or later 4172 View Connection Server or security server 4172 UDP PCoIP (AES-128-GCM only) if PCoIP Secure Gateway is used. View Connection Server * vCenter Server or View Composer 80 TCP SOAP messages if SSL is disabled for access to vCenter Servers or View Composer.
VMware View Security Table 12. TCP and UDP Ports Used by View, Excluding Local Mode (Continued) Source Port Target Port Protocol Description View desktop * View Connection Server instances 4001 TCP JMS traffic. View Composer service * ESXi host 902 TCP Used when View Composer customizes linked-clone disks, including View Composer internal disks and, if they are specified, persistent disks and system disposable disks.
VMware View Security Reference Table 13. TCP and UDP Ports Used by Local Mode (Continued) Source Port Target Port Protocol Description View Connection Server * View Transfer Server 443 TCP View desktop download and data replication if tunnel connections via the View Connection Server are used and SSL is enabled for local mode operations. View Connection Server * View Transfer Server 4001 TCP JMS traffic to support local mode.
VMware View Security Services on a Security Server The operation of View Manager depends on several services that run on a security server. If you want to adjust the operation of these services, you must first familiarize yourself with them. Table 15. Security Server Services Service Name Startup Type Description VMware View Security Server Automatic Provides security server services. This service must be running for the correct operation of a security server.
Index A VMwareVDMDS service 23 accounts 8 ADM template files, security-related settings 9 W Web Component service 23 C Connection Server service 23 F firewall settings 19 Framework Component service 23, 24 L log files 17 M Message Bus Component service 23 R resources 17 S Script Host service 23 Security Gateway Component service 23, 24 security overview 5 Security Server service 24 security servers, services 24 security settings, global 9 server settings.
VMware View Security 26 VMware, Inc.
