6.4
Table Of Contents
- Secure Configuration
- Contents
- Secure Configuration
- vRealize Operations Manager Security Posture
- Secure Deployment of vRealize Operations Manager
- Secure Configuration of vRealize Operations Manager
- Secure the vRealize Operations Manager Console
- Change the Root Password
- Managing Secure Shell, Administrative Accounts, and Console Access
- Enable or Disable Secure Shell on a vRealize Operations Manager node
- Create a Local Administrative Account for Secure Shell
- Restrict Secure Shell Access
- Maintain Secure Shell Key File Permissions
- Harden the Secure Shell Server Configuration
- Harden the Secure Shell Client Configuration
- Disable Direct Logins as Root
- Disable SSH Access for the Admin User Account
- Set Boot Loader Authentication
- Single-User or Maintenance Mode Authentication
- Monitor Minimal Necessary User Accounts
- Monitor Minimal Necessary Groups
- Resetting the vRealize Operations Manager Administrator Password (Linux)
- Configure NTP on VMware Appliances
- Disable the TCP Timestamp Response on Linux
- Enable FIPS 140-2 Mode
- TLS for Data in Transit
- Application Resources That Must be Protected
- Configure PostgreSQL Client Authentication
- Apache Configuration
- Disable Configuration Modes
- Managing Nonessential Software Components
- Secure the USB Mass Storage Handler
- Secure the Bluetooth Protocol Handler
- Secure the Stream Control Transmission Protocol
- Secure the Datagram Congestion Control Protocol
- Secure Reliable Datagram Sockets Protocol
- Secure the Transparent Inter-Process Communication Protocol
- Secure Internet Packet Exchange Protocol
- Secure Appletalk Protocol
- Secure DECnet Protocol
- Secure Firewire Module
- Kernel Message Logging
- Windows Installed Deployment
- Linux Installed Deployment
- Endpoint Operations Management Agent
- Additional Secure Configuration Activities
- Network Security and Secure Communication
- Configuring Network Settings for Virtual Application Installation
- Prevent User Control of Network Interfaces
- Set the Queue Size for TCP Backlog
- Deny ICMPv4 Echoes to Broadcast Address
- Configure the Host System to Disable IPv4 Proxy ARP
- Configure the Host System to Ignore IPv4 ICMP Redirect Messages
- Configure the Host System to Ignore IPv6 ICMP Redirect Messages
- Configure the Host System to Deny IPv4 ICMP Redirects
- Configure the Host System to Log IPv4 Martian Packets
- Configure the Host System to use IPv4 Reverse Path Filtering
- Configure the Host System to Deny IPv4 Forwarding
- Configure the Host System to Deny Forwarding of IPv4 Source Routed Packets
- Configure the Host System to Deny IPv6 Forwarding
- Configure the Host System to Use IPv4 TCP Syncookies
- Configure the Host System to Deny IPv6 Router Advertisements
- Configure the Host System to Deny IPv6 Router Solicitations
- Configure the Host System to Deny IPv6 Router Preference in Router Solicitations
- Configure the Host System to Deny IPv6 Router Prefix
- Configure the Host System to Deny IPv6 Router Advertisement Hop Limit Settings
- Configure the Host System to Deny IPv6 Router Advertisement Autoconf Settings
- Configure the Host System to Deny IPv6 Neighbor Solicitations
- Configure the Host System to Restrict IPv6 Maximum Addresses
- Configuring Ports and Protocols
- Configuring Network Settings for Virtual Application Installation
- Auditing and Logging on your vRealize Operations Manager System
- Index
TLS for Data in Transit
As a security best practice, ensure that the system is deployed with secure transmission channels.
Configure vRealize Operations Manager to Use Strong Ciphers
The encryption strength that is used in a TLS session is determined by the encryption cipher negotiated
between the server and the browser. To ensure that only strong ciphers are selected, you must modify the
server to disable the use of weak ciphers. In addition, you must congure the ciphers in a suitable order. You
must congure the server to support only strong ciphers and to use suciently large key sizes.
Configure Strong Protocols for vRealize Operations Manager
Protocols such as SSLv2 and SSLv3 are no longer considered secure including SSLv2 and SSLv3. As a best
security practice for transport layer protection, provide support for only the TLS protocols.
Prior to production, you must verify that SSLv2 and SSLv3 are disabled.
Disable Weak Ciphers
Disable cipher suites that do not oer authentication such as NULL cipher suites, NULL, or eNULL. No
authentication makes them vulnerable to man-in-the-middle aacks.
You must also disable the anonymous Die-Hellman key exchange (ADH), export level ciphers (EXP,
ciphers containing DES), key sizes smaller than 128 bits for encrypting payload trac, the use of MD5 as a
hashing mechanism for payload trac, IDEA Cipher Suites, and RC4 cipher suites because they are all
vulnerable to aacks.
Disable Weak Ciphers in Apache HTTPD Handler
Disable the weak ciphers and enable strong ciphers that are used in the Apache HTTPD handler.
Prerequisites
For maximum security, review the Apache HTTPD handler ciphers on the vRealize Operations Manager
against the list of acceptable ciphers and disable all of the ciphers that are considered weak. This will help to
prevent man-in-the middle aacks.
Procedure
1 Open the C:\vmware\vrealize-operations\vmware-vcopssuite\utilities\conf le in a text editor.
2 Verify that the le contains the line SSLCipherSuite HIGH:!aNULL!ADH:!EXP:!MD5:!3DES:!CAMELLIA:!
PSK:!SRP:!DH:@STRENGTH.
3 Save the changes you made and close the le.
Enable Diffie-Hellman Key Exchange
Die-Hellman key exchange has weaknesses. Disable all cipher suites that contain DH, DHE, and EDH.
These cipher suites are now disabled by default. You can enable them if you need to use them.
Procedure
1 Open the C:\vmware\vrealize-operations\vmware-vcopssuite\utilities\conf le.
2 Find the line SSLCipherSuite HIGH:!aNULL!ADH:!EXP:!MD5:!3DES:!CAMELLIA:!PSK:!SRP:!DH:@STRENGTH.
3 Remove !DH: so that the line now reads SSLCipherSuite HIGH:!aNULL!ADH:!EXP:!MD5:!3DES:!
CAMELLIA:!PSK:!SRP:@STRENGTH.
4 Save and close the le.
Chapter 3 Secure Configuration of vRealize Operations Manager
VMware, Inc. 33