6.5.1

Procedure
u
Provide templates for virtual machine creation that contain hardened, patched, and properly
configured operating system deployments.
If possible, deploy applications in templates as well. Ensure that the applications do not depend on
information specific to the virtual machine to be deployed.
What to do next
For more information about templates, see the vSphere Virtual Machine Administration documentation.
Minimize Use of the Virtual Machine Console
The virtual machine console provides the same function for a virtual machine that a monitor provides on a
physical server. Users with access to the virtual machine console have access to virtual machine power
management and removable device connectivity controls. Console access might therefore allow a
malicious attack on a virtual machine.
Procedure
1 Use native remote management services, such as terminal services and SSH, to interact with virtual
machines.
Grant access to the virtual machine console only when necessary.
2 Limit the connections to the console.
For example, in a highly secure environment, limit the connection to one. In some environments, you
can increase the limit if several concurrent connections are necessary to accomplish normal tasks.
Prevent Virtual Machines from Taking Over Resources
When one virtual machine consumes so much of the host resources that other virtual machines on the
host cannot perform their intended functions, a Denial of Service (DoS) might occur. To prevent a virtual
machine from causing a DoS, use host resource management features such as setting Shares and using
resource pools.
By default, all virtual machines on an ESXi host share resources equally. You can use Shares and
resource pools to prevent a denial of service attack that causes one virtual machine to consume so much
of the host’s resources that other virtual machines on the same host cannot perform their intended
functions.
Do not use Limits unless you fully understand the impact.
Procedure
1 Provision each virtual machine with just enough resources (CPU and memory) to function properly.
2 Use Shares to guarantee resources to critical virtual machines.
3 Group virtual machines with similar requirements into resource pools.
vSphere Security
VMware, Inc. 133