6.7

Take additional measures to prevent attackers from easily seeing iSCSI data. Neither the hardware iSCSI
adapter nor ESXi iSCSI initiator encrypts the data that they transmit to and from the targets, making the
data more vulnerable to sniffing attacks.
Allowing your virtual machines to share standard switches and VLANs with your iSCSI configuration
potentially exposes iSCSI traffic to misuse by a virtual machine attacker. To help ensure that intruders
cannot listen to iSCSI transmissions, make sure that none of your virtual machines can see the iSCSI
storage network.
If you use a hardware iSCSI adapter, you can accomplish this by making sure that the iSCSI adapter and
ESXi physical network adapter are not inadvertently connected outside the host by virtue of sharing a
switch or some other means. If you configure iSCSI directly through the ESXi host, you can accomplish
this by configuring iSCSI storage through a different standard switch than the one used by your virtual
machines.
In addition to protecting the iSCSI SAN by giving it a dedicated standard switch, you can configure your
iSCSI SAN on its own VLAN to improve performance and security. Placing your iSCSI configuration on a
separate VLAN ensures that no devices other than the iSCSI adapter have visibility into transmissions
within the iSCSI SAN. Also, network congestion from other sources cannot interfere with iSCSI traffic.
Secure iSCSI Ports
When you run iSCSI devices, ESXi does not open any ports that listen for network connections. This
measure reduces the chances that an intruder can break into ESXi through spare ports and gain control
over the host. Therefore, running iSCSI does not present any additional security risks at the ESXi end of
the connection.
Any iSCSI target device that you run must have one or more open TCP ports to listen for iSCSI
connections. If any security vulnerabilities exist in the iSCSI device software, your data can be at risk
through no fault of ESXi. To lower this risk, install all security patches that your storage equipment
manufacturer provides and limit the devices connected to the iSCSI network.
Masking and Zoning SAN Resources
You can use zoning and LUN masking to segregate SAN activity and restrict access to storage devices.
You can protect access to storage in your vSphere environment by using zoning and LUN masking with
your SAN resources. For example, you might manage zones defined for testing independently within the
SAN so they do not interfere with activity in the production zones. Similarly, you might set up different
zones for different departments.
When you set up zones, take into account any host groups that are set up on the SAN device.
Zoning and masking capabilities for each SAN switch and disk array and the tools for managing LUN
masking are vendor specific.
See your SAN vendor's documentation and the vSphere Storage documentation.
Using Kerberos for NFS 4.1
With NFS version 4.1, ESXi supports the Kerberos authentication mechanism.
vSphere Security
VMware, Inc. 221