6.4
Table Of Contents
- Secure Configuration
- Contents
- Secure Configuration
- vRealize Operations Manager Security Posture
- Secure Deployment of vRealize Operations Manager
- Secure Configuration of vRealize Operations Manager
- Secure the vRealize Operations Manager Console
- Change the Root Password
- Managing Secure Shell, Administrative Accounts, and Console Access
- Enable or Disable Secure Shell on a vRealize Operations Manager node
- Create a Local Administrative Account for Secure Shell
- Restrict Secure Shell Access
- Maintain Secure Shell Key File Permissions
- Harden the Secure Shell Server Configuration
- Harden the Secure Shell Client Configuration
- Disable Direct Logins as Root
- Disable SSH Access for the Admin User Account
- Set Boot Loader Authentication
- Single-User or Maintenance Mode Authentication
- Monitor Minimal Necessary User Accounts
- Monitor Minimal Necessary Groups
- Resetting the vRealize Operations Manager Administrator Password (Linux)
- Configure NTP on VMware Appliances
- Disable the TCP Timestamp Response on Linux
- Enable FIPS 140-2 Mode
- TLS for Data in Transit
- Application Resources That Must be Protected
- Configure PostgreSQL Client Authentication
- Apache Configuration
- Disable Configuration Modes
- Managing Nonessential Software Components
- Secure the USB Mass Storage Handler
- Secure the Bluetooth Protocol Handler
- Secure the Stream Control Transmission Protocol
- Secure the Datagram Congestion Control Protocol
- Secure Reliable Datagram Sockets Protocol
- Secure the Transparent Inter-Process Communication Protocol
- Secure Internet Packet Exchange Protocol
- Secure Appletalk Protocol
- Secure DECnet Protocol
- Secure Firewire Module
- Kernel Message Logging
- Windows Installed Deployment
- Linux Installed Deployment
- Endpoint Operations Management Agent
- Additional Secure Configuration Activities
- Network Security and Secure Communication
- Configuring Network Settings for Virtual Application Installation
- Prevent User Control of Network Interfaces
- Set the Queue Size for TCP Backlog
- Deny ICMPv4 Echoes to Broadcast Address
- Configure the Host System to Disable IPv4 Proxy ARP
- Configure the Host System to Ignore IPv4 ICMP Redirect Messages
- Configure the Host System to Ignore IPv6 ICMP Redirect Messages
- Configure the Host System to Deny IPv4 ICMP Redirects
- Configure the Host System to Log IPv4 Martian Packets
- Configure the Host System to use IPv4 Reverse Path Filtering
- Configure the Host System to Deny IPv4 Forwarding
- Configure the Host System to Deny Forwarding of IPv4 Source Routed Packets
- Configure the Host System to Deny IPv6 Forwarding
- Configure the Host System to Use IPv4 TCP Syncookies
- Configure the Host System to Deny IPv6 Router Advertisements
- Configure the Host System to Deny IPv6 Router Solicitations
- Configure the Host System to Deny IPv6 Router Preference in Router Solicitations
- Configure the Host System to Deny IPv6 Router Prefix
- Configure the Host System to Deny IPv6 Router Advertisement Hop Limit Settings
- Configure the Host System to Deny IPv6 Router Advertisement Autoconf Settings
- Configure the Host System to Deny IPv6 Neighbor Solicitations
- Configure the Host System to Restrict IPv6 Maximum Addresses
- Configuring Ports and Protocols
- Configuring Network Settings for Virtual Application Installation
- Auditing and Logging on your vRealize Operations Manager System
- Index
4 Select EP Ops Agent - *HOST_DNS_NAME*.
5 Click Edit Object.
6 Record the agent ID, which is the agent token string.
7 Close the Edit Object dialog box .
8 Select EP Ops Agent - *HOST_DNS_NAME* and click Delete Object.
Reinstate an Agent Resource
When the secure state of a system is recovered, you can reinstate a revoked agent. This ensures that the
agent continues to report on the same resources without losing historical data. To do this you must create a
new Endpoint Operations Management token le by using the same token recorded before you removed the
agent resource. See the section called Removing The Agent Resource.
Prerequisites
n
Ensure that you have the recorded Endpoint Operations Management token string.
n
Use the resource token recorded prior to removing the agent resource from the
vRealize Operations Manager server.
n
Ensure that you have the Manage Agent privilege.
Procedure
1 Create the agent token le with the user that runs the agent.
For example, run the command to create a token le containing the 123-456-789 token.
n
On Linux:
echo 123-456-789 > /etc/epops/epops-token
n
On Windows:
echo 123-456-789 > %PROGRAMDATA%\VMware\Ep Ops Agent\epops-token
In the example, the token le is wrien to the default token location for that platform
2 Install a new agent and register it with the vRealize Operations Manager server. Ensure that the agent
loads the token you inserted in the token le.
You must have the Manage Agent privilege to perform this action.
Agent Certificate Revocation and Update of Certificates
The reissue ow is initiated from the agent using the setup command line argument. When an agent that is
already registered uses the setup command line argument ep-agent.sh setup and lls in the required
credentials, a new registerAgent command is sent to the server.
The server detects that the agent is already registered and sends the agent a new client certicate without
creating another agent resource. On the agent side, the new client certicate replaces the old one. In cases
where the server certicate is modied and you run the ep-agent.sh setup command, you will see a
message that asks you to trust the new certicate. You can alternatively provide the new server certicate
thumbprint in the agent.properties le prior to running the ep-agent.sh setup command, in order to make
the process silent.
Prerequisites
Manage agent privilege to revoke and update certicates.
Secure Configuration
40 VMware, Inc.