6.5.1

Control Access for CIM-Based Hardware Monitoring Tools
The Common Information Model (CIM) system provides an interface that enables hardware-level
management from remote applications using a set of standard APIs. To ensure that the CIM interface is
secure, provide only the minimum access necessary to these remote applications. If you provision a
remote application with a root or Administrator account, and if the application is compromised, the virtual
environment can be compromised.
CIM is an open standard that defines a framework for agent-less, standards-based monitoring of
hardware resources for ESXi hosts. This framework consists of a CIM object manager, often called a CIM
broker, and a set of CIM providers.
CIM providers support management access to device drivers and underlying hardware. Hardware
vendors, including server manufacturers and hardware device vendors, can write providers that monitor
and manage their devices. VMware writes providers that monitor server hardware, ESXi storage
infrastructure, and virtualization-specific resources. These providers run inside the ESXi host and are
lightweight and focused on specific management tasks. The CIM broker takes information from all CIM
providers and presents it to the outside world using standard APIs. The most common API is WS-MAN.
Do not provide root credentials to remote applications that access the CIM interface. Instead, create a
service account for these applications. Grant read-only access to CIM information to any local account
defined on the ESXi system, and any role defined in vCenter Server.
Procedure
1 Create a service account for CIM applications.
2 Grant the service account read-only access to ESXi hosts that collect CIM information.
3 (Optional) If the application requires write access, create a role with only two privileges.
n
Host.Config.SystemManagement
n
Host.CIM.CIMInteraction
4 For each ESXi host that you are monitoring, create a permission that pairs the custom role with the
service account.
See Using Roles to Assign Privileges.
Certificate Management for ESXi Hosts
In vSphere 6.0 and later, the VMware Certificate Authority (VMCA) provisions each new ESXi host with a
signed certificate that has VMCA as the root certificate authority by default. Provisioning happens when
the host is added to vCenter Server explicitly or as part of installation or upgrade to ESXi 6.0 or later.
You can view and manage ESXi certificates from the vSphere Web Client and by using the
vim.CertificateManager API in the vSphere Web Services SDK. You cannot view or manage ESXi
certificates by using certificate management CLIs that are available for managing vCenter Server
certificates.
vSphere Security
VMware, Inc. 53