6.4

Disable Configuration Modes
As a best practice, when you install, congure, or maintain vRealize Operations Manager, you can modify
the conguration or seings to enable troubleshooting and debugging of your installation.
Catalog and audit each of the changes you make to ensure that they are properly secured. Do not put the
changes into production if you are not sure that your conguration changes are correctly secured.
Verifying the Host Server's Secure Baseline
You can use the Microsoft Baseline Security Analyzer (MBSA) to check whether your server has the latest
updates or hot xes. You can use MBSA to install any missing security patches from Microsoft to keep your
server up-to-date with Microsoft security recommendations. You can download this tool from Microsoft.
The latest tool, at the time this document was published, can be found here: hp://www.microsoft.com/en-
us/download/details.aspx?id=7558.
N Contact your Microsoft vendor for guidance on the most appropriate use of this tool.
Verifying that the Host Server Is Securely Configured
You can use the Windows Security Conguration Wizard (SCW) and the Microsoft Security Compliance
Manager toolkit to verify that the host server is securely congured.
1 Start the SCW from the administrative tools of your Windows server. This tool can identify the roles of
your server and the installed features including networking, Windows rewalls, and registry seings.
2 Compare the report with the latest hardening guidance from the relevant Microsoft Security
Compliance Manager (SCM) for your Windows server.
3 Based on the results, you can congure the security seings for each feature such as network services,
account seings, and Windows rewalls, and apply the seings to your server.
For more information on the SCW tool, go to hp://technet.microsoft.com/en-us/library/cc754997.aspx.
N Contact your Microsoft vendor for guidance on the most appropriate use of these tools.
Linux Installed Deployment
Enabling NTP Service
For critical time sourcing, you can disable the host time synchronization and use the Network Time Protocol
(NTP). NTP in production is a means to accurately track user actions and to realize potential malicious
aacks and intrusion through accurate audit and log keeping.
The ntp daemon is included on the appliance and is used to provide synchronized time services. You can
nd the conguration le for NTP in /etc/ntp.conf.
TLS for Data in Transit
As a security best practice, ensure that the system is deployed with secure transmission channels.
Configure Strong Protocols for vRealize Operations Manager
Protocols such as SSLv2 and SSLv3 are no longer considered secure including SSLv2 and SSLv3. As a best
security practice for transport layer protection, provide support for only the TLS protocols.
Prior to production, you must verify that SSLv2 and SSLv3 are disabled.
Secure Configuration
34 VMware, Inc.