6.6

Network Security and Secure
Communication 4
As a security best practice, review and edit the network communication seings of your VMware virtual
appliances and host machines. You must also congure the minimum incoming and outgoing ports for
vRealize Operations Manager.
This chapter includes the following topics:
n
“Conguring Network Seings for Virtual Application Installation,” on page 39
n
“Conguring Ports and Protocols,” on page 47
Configuring Network Settings for Virtual Application Installation
To ensure that your VMware virtual appliance and host machines allow only safe and essential
communication, review and edit their network communication seings.
Prevent User Control of Network Interfaces
As a security best practice, restrict the ability to change the network interface seing to privileged users. If
users manipulate network interfaces, it might result in bypassing network security mechanisms or denial of
service. Ensure that network interfaces are not congured for user control.
Procedure
1 To verify user control seings, run the #grep -i '^USERCONTROL=' /etc/sysconfig/network/ifcfg*
command.
2 Make sure that each interface is set to NO.
Set the Queue Size for TCP Backlog
As a security best practice, congure a default TCP backlog queue size on VMware appliance host machines.
To mitigate TCP denial or service aacks, set an appropriate default size for the TCP backlog queue size. The
recommended default seing is 1280.
Procedure
1 Run the # cat /proc/sys/net/ipv4/tcp_max_syn_backlog command on each VMware appliance host
machine.
VMware, Inc.
39