vSphere Security Update 2 Modified on 14 AUG 2020 VMware vSphere 6.5 VMware ESXi 6.5 vCenter Server 6.5 vSphere Security You can find the most up-to-date technical documentation on the VMware website at: https://docs.vmware.com/ VMware, Inc. 3401 Hillview Ave. Palo Alto, CA 94304 www.vmware.com © Copyright 2009-2020 VMware, Inc. All rights reserved. Copyright and trademark information. VMware, Inc. 2 Contents About vSphere Security 11 Updated Information 13 1 Security in the vSphere Environment 15 Securing the ESXi Hypervisor 15 Securing vCenter Server Systems and Associated Services 17 Securing Virtual Machines 18 Securing the Virtual Networking Layer 19 Passwords in Your vSphere Environment 21 Security Best Practices and Resources 22 2 vSphere Permissions and User Management Tasks 24 Understanding Authorization in vSphere 25 Understanding the vCenter Server Permission Model 25 Hierarchical Inheritance of Permissions 27 Multiple Permission Settings 29 Example 1: Inheritance of Multiple Permissions 30 Example 2: Child Permissions Overriding Parent Permissions 30 Example 3: User Role Overriding Group Role 31 Managing Permissions for vCenter Components 31 Add a Permission to an Inventory Object 32 Change Permissions 33 Remove Permissions 34 Change User Validation Settings 34 Global Permissions 35 Add a Global Permission 36 Permissions on Tag Objects 36 Using Roles to Assign Privileges 38 vCenter Server System Roles 39 Create a Custom Role 40 Clone a Role 41 Edit a Role 41 Best Practices for Roles and Permissions 42 Required Privileges for Common Tasks 43 3 Securing ESXi Hosts 46 Configure ESXi Hosts with Host Profiles 47 VMware, Inc. 3 vSphere Security General ESXi Security Recommendations 47 Use Scripts to Manage Host Configuration Settings 49 ESXi Passwords and Account Lockout 50 SSH Security 52 ESXi SSH Keys 53 PCI and PCIe Devices and ESXi 55 Disable the Managed Object Browser 55 ESXi Networking Security Recommendations 56 Modifying ESXi Web Proxy Settings 56 vSphere Auto Deploy Security Considerations 57 Control Access for CIM-Based Hardware Monitoring Tools 58 Certificate Management for ESXi Hosts 59 Host Upgrades and Certificates 61 Certificate Mode Switch Workflows 62 ESXi Certificate Default Settings 64 Change Certificate Default Settings 65 View Certificate Expiration Information for Multiple ESXi Hosts 66 View Certificate Details for a Single ESXi Host 66 Renew or Refresh ESXi Certificates 67 Change the Certificate Mode 68 Replacing ESXi SSL Certificates and Keys 68 Requirements for ESXi Certificate Signing Requests 69 Replace the Default Certificate and Key from the ESXi Shell 70 Replace a Default Certificate and Key with the vifs Command 71 Replace a Default Certificate Using HTTPS PUT 71 Update the vCenter Server TRUSTED_ROOTS Store (Custom Certificates) 72 Use Custom Certificates with Auto Deploy 73 Restore ESXi Certificate and Key Files 75 Customizing Hosts with the Security Profile 76 ESXi Firewall Configuration 76 Manage ESXi Firewall Settings 77 Add Allowed IP Addresses for an ESXi Host 78 Incoming and Outgoing Firewall Ports for ESXi Hosts 78 NFS Client Firewall Behavior 81 ESXi ESXCLI Firewall Commands 82 Customizing ESXi Services from the Security Profile 83 Enable or Disable a Service in the Security Profile 84 Lockdown Mode 85 Lockdown Mode Behavior 86 Enable Lockdown Mode Using the vSphere Web Client 87 Disable Lockdown Mode Using the vSphere Web Client 88 VMware, Inc. 4 vSphere Security Enable or Disable Normal Lockdown Mode from the Direct Console User Interface 89 Specifying Accounts with Access Privileges in Lockdown Mode 89 Manage the Acceptance Levels of Hosts and VIBs 91 Assigning Privileges for ESXi Hosts 93 root User Privileges 94 vpxuser Privileges 94 dcui User Privileges 95 Using Active Directory to Manage ESXi Users 95 Configure a Host to Use Active Directory 95 Add a Host to a Directory Service Domain 97 View Directory Service Settings 97 Using vSphere Authentication Proxy 98 Enable vSphere Authentication Proxy 99 Add a Domain to vSphere Authentication Proxy with the vSphere Web Client 99 Add a Domain to vSphere Authentication Proxy with the camconfig Command 100 Use vSphere Authentication Proxy to Add a Host to a Domain 101 Enable Client Authentication for vSphere Authentication Proxy 102 Import the vSphere Authentication Proxy Certificate to ESXi Host 102 Generate a New Certificate for vSphere Authentication Proxy 103 Set Up vSphere Authentication Proxy to Use Custom Certificates 104 Configuring Smart Card Authentication for ESXi 106 Enable Smart Card Authentication 107 Disable Smart Card Authentication 107 Authenticating With User Name and Password in Case of Connectivity Problems 108 Using Smart Card Authentication in Lockdown Mode 108 Using the ESXi Shell 108 Use the vSphere Web Client to Enable Access to the ESXi Shell 109 Create a Timeout for ESXi Shell Availability in the vSphere Web Client 110 Create a Timeout for Idle ESXi Shell Sessions in the vSphere Web Client 110 Use the Direct Console User Interface (DCUI) to Enable Access to the ESXi Shell 111 Create a Timeout for ESXi Shell Availability in the Direct Console User Interface 112 Create a Timeout for Idle ESXi Shell Sessions 112 Log in to the ESXi Shell for Troubleshooting 113 UEFI Secure Boot for ESXi Hosts 113 Run the Secure Boot Validation Script on an Upgraded ESXi Host 115 ESXi Log Files 116 Configure Syslog on ESXi Hosts 116 ESXi Log File Locations 117 Securing Fault Tolerance Logging Traffic 118 4 Securing vCenter Server Systems 119 VMware, Inc. 5 vSphere Security vCenter Server Security Best Practices 119 Best Practices for vCenter Server Access Control 119 Set the vCenter Server Password Policy 121 Removing Expired or Revoked Certificates and Logs from Failed Installations 121 Protecting the vCenter Server Windows Host 122 Limiting vCenter Server Network Connectivity 122 Evaluate the Use of Linux Clients with CLIs and SDKs 123 Examine vSphere Web Client Plug-Ins 123 vCenter Server Appliance Security Best Practices 124 vCenter Password Requirements and Lockout Behavior 124 Verify Thumbprints for Legacy ESXi Hosts 125 Verify that SSL Certificate Validation Over Network File Copy Is Enabled 126 Required Ports for vCenter Server and Platform Services Controller 127 Additional vCenter Server TCP and UDP Ports 133 5 Securing Virtual Machines 136 Enable or Disable UEFI Secure Boot for a Virtual Machine 136 Limit Informational Messages From Virtual Machines to VMX Files 138 Prevent Virtual Disk Shrinking 138 Virtual Machine Security Best Practices 139 General Virtual Machine Protection 140 Use Templates to Deploy Virtual Machines 141 Minimize Use of the Virtual Machine Console 141 Prevent Virtual Machines from Taking Over Resources 141 Disable Unnecessary Functions Inside Virtual Machines 142 Remove Unnecessary Hardware Devices 143 Disable Unused Display Features 143 Disable Unexposed Features 144 Disable VMware Shared Folders Sharing Host Files to the Virtual Machine 145 Disable Copy and Paste Operations Between Guest Operating System and Remote Console 145 Limiting Exposure of Sensitive Data Copied to the Clipboard 146 Restrict Users From Running Commands Within a Virtual Machine 146 Prevent a Virtual Machine User or Process From Disconnecting Devices 147 Prevent Guest Operating System Processes from Sending Configuration Messages to the Host 148 Avoid Using Independent Nonpersistent Disks 148 6 Virtual Machine Encryption 150 How vSphere Virtual Machine Encryption Protects Your Environment 151 vSphere Virtual Machine Encryption Components 153 Encryption Process Flow 154 VMware, Inc. 6 vSphere Security Virtual Disk Encryption 156 Prerequisites and Required Privileges for Encryption Tasks 157 Encrypted vSphere vMotion 158 Encryption Best Practices, Caveats, and Interoperability 159 Virtual Machine Encryption Best Practices 160 Virtual Machine Encryption Caveats 162 Virtual Machine Encryption Interoperability 163 7 Use Encryption in Your vSphere Environment 166 Set up the Key Management Server Cluster 166 Add a KMS to vCenter Server 166 Establish a Trusted Connection by Exchanging Certificates 168 Use the Root CA Certificate Option to Establish a Trusted Connection 168 Use the Certificate Option to Establish a Trusted Connection 169 Use the New Certificate Signing Request Option to Establish a Trusted Connection 169 Use the Upload Certificate and Private Key Option to Establish a Trusted Connection 170 Set the Default KMS Cluster 171 Complete the Trust Setup 171 Set Up Separate KMS Clusters for Different Users 172 Create an Encryption Storage Policy 173 Enable Host Encryption Mode Explicitly 174 Disable Host Encryption Mode 174 Create an Encrypted Virtual Machine 175 Clone an Encrypted Virtual Machine 176 Encrypt an Existing Virtual Machine or Virtual Disk 176 Decrypt an Encrypted Virtual Machine or Virtual Disk 177 Change the Encryption Policy for Virtual Disks 178 Resolve Missing Key Issues 179 Resolve ESXi Host Encryption Mode Issues 180 Set Key Management Server Certificate Expiration Threshold 181 vSphere Virtual Machine Encryption and Core Dumps 181 Collect a vm-support Package for an ESXi Host That Uses Encryption 182 Decrypt or Re-Encrypt an Encrypted Core Dump 184 8 Securing vSphere Networking 185 Introduction to vSphere Network Security 185 Securing the Network With Firewalls 187 Firewalls for Configurations With vCenter Server 187 Connecting to vCenter Server Through a Firewall 188 Connecting ESXi Hosts Through Firewalls 188 Firewalls for Configurations Without vCenter Server 189 VMware, Inc. 7 vSphere Security