6.5.1

Security in the vSphere
Environment 1
The components of a vSphere environment are secured out of the box by several features such as
authentication, authorization, a firewall on each ESXi host, and so on. You can modify the default setup in
many ways. For example, you can set permissions on vCenter objects, open firewall ports, or change the
default certificates. You can take security measures for different objects in the vCenter object hierarchy,
for example, vCenter Server systems, ESXi hosts, virtual machines, and network and storage objects.
A high-level overview of different areas of vSphere that require attention helps you plan your security
strategy. You also benefit from other vSphere Security resources on the VMware Web site.
This section includes the following topics:
n
Securing the ESXi Hypervisor
n
Securing vCenter Server Systems and Associated Services
n
Securing Virtual Machines
n
Securing the Virtual Networking Layer
n
Passwords in Your vSphere Environment
n
Security Best Practices and Resources
Securing the ESXi Hypervisor
The ESXi hypervisor is secured out of the box. You can further protect ESXi hosts by using lockdown
mode and other built-in features. For consistency, you can set up a reference host and keep all hosts in
sync with the host profile of the reference host. You can also protect your environment by performing
scripted management, which ensures that changes apply to all hosts.
You can enhance protection of ESXi hosts that are managed by vCenter Server with the following actions.
See the Security of the VMware vSphere Hypervisor white paper for background and details.
Limit ESXi access By default, the ESXi Shell and SSH services are not running and only the
root user can log in to the Direct Console User Interface (DCUI). If you
decide to enable ESXi or SSH access, you can set timeouts to limit the risk
of unauthorized access.
VMware, Inc. 10