6.5.1
Table Of Contents
- vSphere Security
- Contents
- About vSphere Security
- Updated Information
- Security in the vSphere Environment
- vSphere Permissions and User Management Tasks
- Securing ESXi Hosts
- Configure ESXi Hosts with Host Profiles
- General ESXi Security Recommendations
- Use Scripts to Manage Host Configuration Settings
- ESXi Passwords and Account Lockout
- SSH Security
- PCI and PCIe Devices and ESXi
- Disable the Managed Object Browser
- ESXi Networking Security Recommendations
- Modifying ESXi Web Proxy Settings
- vSphere Auto Deploy Security Considerations
- Control Access for CIM-Based Hardware Monitoring Tools
- Certificate Management for ESXi Hosts
- Host Upgrades and Certificates
- Certificate Mode Switch Workflows
- ESXi Certificate Default Settings
- View Certificate Expiration Information for Multiple ESXi Hosts
- View Certificate Details for a Single ESXi Host
- Renew or Refresh ESXi Certificates
- Change the Certificate Mode
- Replacing ESXi SSL Certificates and Keys
- Use Custom Certificates With Auto Deploy
- Restore ESXi Certificate and Key Files
- Customizing Hosts with the Security Profile
- ESXi Firewall Configuration
- Customizing ESXi Services from the Security Profile
- Enable or Disable a Service in the Security Profile
- Lockdown Mode
- Manage the Acceptance Levels of Hosts and VIBs
- Assigning Privileges for ESXi Hosts
- Using Active Directory to Manage ESXi Users
- Using vSphere Authentication Proxy
- Enable vSphere Authentication Proxy
- Add a Domain to vSphere Authentication Proxy with the vSphere Web Client
- Add a Domain to vSphere Authentication Proxy with the camconfig Command
- Use vSphere Authentication Proxy to Add a Host to a Domain
- Enable Client Authentication for vSphere Authentication Proxy
- Import the vSphere Authentication Proxy Certificate to ESXi Host
- Generate a New Certificate for vSphere Authentication Proxy
- Set Up vSphere Authentication Proxy to Use Custom Certificates
- Configuring Smart Card Authentication for ESXi
- Using the ESXi Shell
- UEFI Secure Boot for ESXi Hosts
- ESXi Log Files
- Securing vCenter Server Systems
- vCenter Server Security Best Practices
- Verify Thumbprints for Legacy ESXi Hosts
- Verify that SSL Certificate Validation Over Network File Copy Is Enabled
- Required Ports for vCenter Server and Platform Services Controller
- Additional vCenter Server TCP and UDP Ports
- Securing Virtual Machines
- Enable or Disable UEFI Secure Boot for a Virtual Machine
- Limit Informational Messages From Virtual Machines to VMX Files
- Prevent Virtual Disk Shrinking
- Virtual Machine Security Best Practices
- General Virtual Machine Protection
- Use Templates to Deploy Virtual Machines
- Minimize Use of the Virtual Machine Console
- Prevent Virtual Machines from Taking Over Resources
- Disable Unnecessary Functions Inside Virtual Machines
- Remove Unnecessary Hardware Devices
- Disable Unused Display Features
- Disable Unexposed Features
- Disable HGFS File Transfers
- Disable Copy and Paste Operations Between Guest Operating System and Remote Console
- Limiting Exposure of Sensitive Data Copied to the Clipboard
- Restrict Users From Running Commands Within a Virtual Machine
- Prevent a Virtual Machine User or Process From Disconnecting Devices
- Prevent Guest Operating System Processes from Sending Configuration Messages to the Host
- Avoid Using Independent Nonpersistent Disks
- Virtual Machine Encryption
- Use Encryption in Your vSphere Environment
- Set up the Key Management Server Cluster
- Create an Encryption Storage Policy
- Enable Host Encryption Mode Explicitly
- Disable Host Encryption Mode
- Create an Encrypted Virtual Machine
- Clone an Encrypted Virtual Machine
- Encrypt an Existing Virtual Machine or Virtual Disk
- Decrypt an Encrypted Virtual Machine or Virtual Disk
- Change the Encryption Policy for Virtual Disks
- Resolve Missing Key Issues
- vSphere Virtual Machine Encryption and Core Dumps
- Securing vSphere Networking
- Introduction to vSphere Network Security
- Securing the Network With Firewalls
- Secure the Physical Switch
- Securing Standard Switch Ports with Security Policies
- Securing vSphere Standard Switches
- Standard Switch Protection and VLANs
- Secure vSphere Distributed Switches and Distributed Port Groups
- Securing Virtual Machines with VLANs
- Creating Multiple Networks Within a Single ESXi Host
- Internet Protocol Security
- Ensure Proper SNMP Configuration
- vSphere Networking Security Best Practices
- Best Practices Involving Multiple vSphere Components
- Synchronizing Clocks on the vSphere Network
- Storage Security Best Practices
- Verify That Sending Host Performance Data to Guests is Disabled
- Setting Timeouts for the ESXi Shell and vSphere Web Client
- Managing TLS Protocol Configuration with the TLS Configurator Utility
- Ports That Support Disabling TLS Versions
- Disabling TLS Versions in vSphere
- Install the TLS Configuration Utility
- Perform an Optional Manual Backup
- Disable TLS Versions on vCenter Server Systems
- Disable TLS Versions on ESXi Hosts
- Disable TLS Versions on Platform Services Controller Systems
- Revert TLS Configuration Changes
- Disable TLS Versions on vSphere Update Manager
- Defined Privileges
- Alarms Privileges
- Auto Deploy and Image Profile Privileges
- Certificates Privileges
- Content Library Privileges
- Cryptographic Operations Privileges
- Datacenter Privileges
- Datastore Privileges
- Datastore Cluster Privileges
- Distributed Switch Privileges
- ESX Agent Manager Privileges
- Extension Privileges
- Folder Privileges
- Global Privileges
- Host CIM Privileges
- Host Configuration Privileges
- Host Inventory
- Host Local Operations Privileges
- Host vSphere Replication Privileges
- Host Profile Privileges
- Network Privileges
- Performance Privileges
- Permissions Privileges
- Profile-driven Storage Privileges
- Resource Privileges
- Scheduled Task Privileges
- Sessions Privileges
- Storage Views Privileges
- Tasks Privileges
- Transfer Service Privileges
- Virtual Machine Configuration Privileges
- Virtual Machine Guest Operations Privileges
- Virtual Machine Interaction Privileges
- Virtual Machine Inventory Privileges
- Virtual Machine Provisioning Privileges
- Virtual Machine Service Configuration Privileges
- Virtual Machine Snapshot Management Privileges
- Virtual Machine vSphere Replication Privileges
- dvPort Group Privileges
- vApp Privileges
- vServices Privileges
- vSphere Tagging Privileges
n
If the nfsClient rule set is enabled, the state of the rule set and the allowed IP address policy are
not changed. The IP address of the NFS server is added to the allowed list of outgoing IP addresses.
Note If you manually enable the nfsClient rule set or manually set the Allow All IP Addresses policy,
either before or after you add an NFS v3 datastore to the system, your settings are overridden when the
last NFS v3 datastore is unmounted. The nfsClient rule set is disabled when all NFS v3 datastores are
unmounted.
When you remove or unmount an NFS v3 datastore, ESXi performs one of the following actions.
n
If none of the remaining NFS v3 datastores are mounted from the server of the datastore being
unmounted, ESXi removes the server's IP address from the list of outgoing IP addresses.
n
If no mounted NFS v3 datastores remain after the unmount operation, ESXi disables the nfsClient
firewall rule set.
NFS v4.1 Firewall Behavior
When you mount the first NFS v4.1 datastore, ESXi enables the nfs41client rule set and sets its
allowedAll flag to TRUE. This action opens port 2049 for all IP addresses. Unmounting an NFS v4.1
datastore does not affect the firewall state. That is, the first NFS v4.1 mount opens port 2049 and that port
remains enabled unless you close it explicitly.
ESXi ESXCLI Firewall Commands
If your environment includes multiple ESXi hosts, automating firewall configuration by using ESXCLI
commands or the vSphere Web Services SDK is recommended.
Firewall Command Reference
You can use the ESXi Shell or vSphere CLI commands to configure ESXi at the command line to
automate firewall configuration. See Getting Started with vSphere Command-Line Interfaces for an
introduction, and vSphere Command-Line Interface Concepts and Examples for examples of using
ESXCLI to manipulate firewalls and firewall rules.
Table 3‑7. Firewall Commands
Command Description
esxcli network firewall get
Return the enabled or disabled status of the firewall and lists
default actions.
esxcli network firewall set --default-action
Set to true to set the default action to pass. Set to false to set
the default action to drop.
esxcli network firewall set --enabled
Enable or disable the ESXi firewall.
esxcli network firewall load
Load the firewall module and rule set configuration files.
esxcli network firewall refresh
Refresh the firewall configuration by reading the rule set files if
the firewall module is loaded.
esxcli network firewall unload
Destroy filters and unload the firewall module.
esxcli network firewall ruleset list
List rule sets information.
vSphere Security
VMware, Inc. 75