vsphere-esxi-vcenter-server-51-security-guide

vSphere Security

ESXi 5.1

vCenter Server 5.1 This document supports the version of each product listed and supports all subsequent versions until the document is replaced by a new edition. To check for more recent editions of this document, see b54cec67b84ae45c3b358c66/support/pubs.

EN-000792-02

vSphere Security

2 VMware, Inc.You can find the most up-to-date technical documentation on the VMware Web site at:

b54cec67b84ae45c3b358c66/support/

The VMware Web site also provides the latest product updates.

If you have comments about this documentation, submit your feedback to:

docfeedback@b54cec67b84ae45c3b358c66

Copyright ? 2009–2012 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed at b54cec67b84ae45c3b358c66/go/patents .

VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respective companies.

VMware, Inc.3401 Hillview Ave.Palo Alto, CA b54cec67b84ae45c3b358c66

Contents

About vSphere Security7

Updated Information9

1Security for ESXi Systems11

ESXi Architecture and Security Features11

Security Resources and Information18

2Securing ESXi Configurations19

Securing the Network with Firewalls19

Securing Virtual Machines with VLANs24

Securing Standard Switch Ports29

Internet Protocol Security30

Securing iSCSI Storage34

Cipher Strength36

Control CIM-Based Hardware Monitoring Tool Access36

3Securing the Management Interface39

General Security Recommendations39

ESXi Firewall Configuration40

ESXi Firewall Commands45

4Using the ESXi Shell47

Use the vSphere Client to Enable Access to the ESXi Shell47

Use the vSphere Web Client to Enable Access to the ESXi Shell49

Use the Direct Console User Interface (DCUI) to Enable Access to the ESXi Shell 50

Log in to the ESXi Shell for Troubleshooting51

5Lockdown Mode53

Lockdown Mode Behavior54

Lockdown Mode Configurations54

Enable Lockdown Mode Using the vSphere Client55

Enable Lockdown Mode Using the vSphere Web Client55

Enable Lockdown Mode from the Direct Console User Interface55

6ESXi Authentication and User Management57

Managing Users with the vSphere Client57

Password Requirements59

Assigning Permissions for ESXi60

Assigning ESXi Roles71

Using Active Directory to Manage Users and Groups74

VMware, Inc. 3

vSphere Security

Using vSphere Authentication Proxy76

7vCenter Server Authentication and User Management83

Using vCenter Single Sign-On with vSphere84

How vCenter Single Sign-On Deployment Scenarios Affect Log In Behavior84

Configuring vCenter Single Sign-On87

Using vCenter Single Sign On to Manage Users and Groups95

vCenter Server User Directory Settings100

Assigning Permissions for vCenter Server101

Assigning Roles in the vSphere Web Client104

Manually Replicate Data in a Multisite vCenter Single Sign-On Deployment106

Troubleshooting vCenter Single Sign-On108

8Encryption and Security Certificates113

Generate New Certificates for ESXi114

Enable SSL Certificate Validation Over NFC114

Upload an SSL Certificate and Key Using HTTPS PUT115

Replace a Default ESXi Certificate with a CA-Signed Certificate115

Replace a Default ESXi Certificate with a CA-Signed Certificate Using the vifs Command116

Upload an SSH Key Using HTTPS PUT116

Upload an SSH Key Using a vifs Command117

Configure SSL Timeouts117

Modifying ESXi Web Proxy Settings118

Enable Certificate Checking and Verify Host Thumbprints122

Enable Certificate Checking and Verify Host Thumbprints in the vSphere Web Client122 9Securing Virtual Machines125

General Virtual Machine Protection125

Configuring Logging Levels for the Guest Operating System129

Limiting Exposure of Sensitive Data Copied to the Clipboard132

Disable Unexposed Features133

Limiting Guest Operating System Writes to Host Memory134

Removing Unnecessary Hardware Devices136

Prevent a Virtual Machine User or Process from Disconnecting Devices136

Prevent a Virtual Machine User or Process from Disconnecting Devices in the vSphere Web Client137 10Securing vCenter Server Systems139

Hardening the vCenter Server Host Operating System139

Best Practices for vCenter Server Privileges139

Limiting vCenter Server Network Connectivity141

Restricting Use of Linux-Based Clients141

Verifying the Integrity of the vSphere Client142

Set an Inactivity Timeout for the vSphere Client142

Disable Sending Host Performance Data to Guests142

11Best Practices for Virtual Machine and Host Security145

Installing Antivirus Software145

Managing ESXi Log Files146

4 VMware, Inc.

Contents Securing Fault Tolerance Logging Traffic148

Auto Deploy Security Considerations148

Image Builder Security Considerations148

Host Password Strength and Complexity149

Synchronizing Clocks on the vSphere Network151

Disable Shell Access for Anonymous Users152

Limit DCUI Access in Lockdown Mode152

Disable the Managed Object Browser (MOB)153

Disable Authorized (SSH) Keys153

Establish and Maintain Configuration File Integrity154

Monitoring and Restricting Access to SSL Certificates154

Delete VMDK Files Securely154

Index157

VMware, Inc. 5

vSphere Security

6 VMware, Inc.

About vSphere Security

vSphere Security provides information about securing your vSphere? environment for VMware? vCenter?

Server and VMware ESXi.

To help you protect your ESXi? installation, this documentation describes security features built in to ESXi and the measures that you can take to safeguard it from attack.

Intended Audience

This information is intended for anyone who wants to secure their ESXi configuration. The information is

written for experienced Windows or Linux system administrators who are familiar with virtual machine

technology and datacenter operations.

VMware, Inc. 7

vSphere Security

8 VMware, Inc.

Updated Information

This vSphere Security documentation is updated with each release of the product or when necessary.

This table provides the update history of the vSphere Security documentation.

Revision Description

EN-000792-02n Corrected command syntax in “Import vCenter Single Sign On Multisite Replication Data,” on

page 108.

n Added 'Turn off the Virtual Machine' to the prerequisites in “Modify Guest Operating System Variable Memory Limit in the vSphere Web Client,” on page 135 and “Prevent the Guest Operating System

Processes from Sending Configuration Messages to the Host in the vSphere Web Client,” on

page 135.

n Minor edits.

EN- 000792-01n Added section on troubleshooting Single Sign-On, at “Troubleshooting vCenter Single Sign-On,” on page 108.

n Updated list of TCP and UDP ports needed for vCenter Virtual Appliance at “TCP and UDP Ports for Management Access,” on page 23

n Added note indicating that the process for configuring and replacing certificates is different for the

vCenter Server Virtual Appliance.

n Changed Note text, User name description, and Password description in Step 4 of “Add a vCenter

Single Sign On Identity Source,” on page 89.

n Minor edits.

EN- 000792-00Initial release.

VMware, Inc. 9

vSphere Security

10 VMware, Inc.

Security for ESXi Systems1 ESXi is developed with a focus on strong security. VMware ensures security in the ESXi environment and

addresses system architecture from a security standpoint.

This chapter includes the following topics:

n“ESXi Architecture and Security Features,” on page 11

n“Security Resources and Information,” on page 18

ESXi Architecture and Security Features

The components and the overall architecture of ESXi are designed to ensure security of the ESXi system as a whole.

From a security perspective, ESXi consists of three major components: the virtualization layer, the virtual

machines, and the virtual networking layer.

ESXi Architecture

Figure 1-1.

VMware, Inc. 11

Security and the Virtualization Layer

VMware designed the virtualization layer, or VMkernel, to run virtual machines. It controls the hardware that hosts use and schedules the allocation of hardware resources among the virtual machines. Because the

VMkernel is fully dedicated to supporting virtual machines and is not used for other purposes, the interface to the VMkernel is strictly limited to the API required to manage virtual machines.

ESXi provides additional VMkernel protection with the following features:

Memory Hardening The ESXi kernel, user-mode applications, and executable components such as

drivers and libraries are located at random, non-predictable memory

addresses. Combined with the non-executable memory protections made

available by microprocessors, this provides protection that makes it difficult

for malicious code to use memory exploits to take advantage of vulnerabilities.

Kernel Module Integrity Digital signing ensures the integrity and authenticity of modules, drivers and

applications as they are loaded by the VMkernel. Module signing allows

ESXi to identify the providers of modules, drivers, or applications and whether

they are VMware-certified. VMware software and certain third-party drivers

are signed by VMware.

Trusted Platform Module (TPM)vSphere uses Intel Trusted Platform Module/Trusted Execution Technology (TPM/TXT) to provide remote attestation of the hypervisor image based on hardware root of trust. The hypervisor image comprises the following elements:

搜索“diyifanwen.net”或“第一范文网”即可找到本站免费阅读全部范文。收藏本站方便下次阅读，第一范文网，提供最新实用文档vsphere-esxi-vcenter-server-51-security-guide全文阅读和word下载服务。