6.5.1

For additional protection, explicitly remove expired or revoked certificates
and failed installations.
Configure vCenter
Single Sign-On
vCenter Server and associated services are protected by the vCenter
Single Sign-On authentication framework. When you first install the
software, you specify a password for the administrator of the vCenter
Single Sign-On domain, [e-mail] by default. Only that
domain is initially available as an identity source. You can add other identity
sources, either Active Directory or LDAP, and set a default identity source.
Going forward, users who can authenticate to one of those identity sources
can view objects and perform tasks if they are authorized to do so. See the
Platform Services Controller Administration documentation for details.
Assign roles to named
users or groups
For better logging, associate each permission that you give on an object
with a named user or group and a predefined role or custom role. The
vSphere 6.0 permissions model allows great flexibility through multiple
ways of authorizing users or groups. See Understanding Authorization in
vSphere and Required Privileges for Common Tasks.
Restrict administrator privileges and the use of the administrator role. If
possible, do not use the anonymous Administrator user.
Set up NTP Set up NTP for each node in your environment. The certificate
infrastructure requires an accurate time stamp and does not work correctly
if the nodes are out of sync.
See Synchronizing Clocks on the vSphere Network.
Securing Virtual Machines
To secure your VMs, keep the guest operating systems patched and protect your environment just as you
protect your physical machine. Consider disabling unnecessary functionality, minimize the use of the VM
console, and follow other best practices.
Protect the guest
operating system
To protect your guest operating system, make sure that it uses the most
recent patches and, if appropriate, anti-spyware and anti-malware
applications. See the documentation from your guest operating system
vendor and, potentially, other information available in books or on the
Internet for that operating system.
Disable unnecessary
functionality
Check that unnecessary functionality is disabled to minimize potential
points of attack. Many of the features that are used infrequently are
disabled by default. Remove unnecessary hardware and disable certain
features such as host-guest filesystem (HGFS) or copy and paste between
the VM and a remote console.
See Disable Unnecessary Functions Inside Virtual Machines.
vSphere Security
VMware, Inc. 13