Articles tagged with: vsphere hardening

vSphere Hardening – G3 : Mask and zone SAN resources appropriately

Guideline ID : ESXi.mask-zone-san

Vulnerability Discussion : You should use zoning and LUN masking to segregate SAN activity. For example, you manage zones defined for testing independently within the SAN so they do not interfere with activity in the production zones. Similarly, you can set up different zones for different departments. Zoning must take into account any host groups that have been set up on the SAN device.

Risk Profile : 1, 2, 3

Description : Mask and zone SAN resources appropriately.

Zoning provides access control in the SAN topology. Zoning defines which HBAs can connect to which targets. When … Read The Rest ......

vSphere Hardening – G2 : Configure Host Profiles to monitor and alert on configuration changes

 

Guideline ID : ESXi.enable-host-profiles

Vulnerability Discussion : Monitoring for configuration drift and unauthorized changes is critical to ensuring the security of an ESXi host. Host Profiles provide an automated method for monitoring host configurations against an established template and for providing notification if deviations are detected.

Risk Profile : 1, 2, 3

Description : Configure Host Profiles to monitor and alert on configuration changes

Create Host profile 

  1. Log in to the Webclient of your vCenter server and click on host profile .
    1
  2. click on the + Sign to create new host profile andit will pop up an wizard
    2
  3. Select
Read The Rest ......

vSphere Hardening – G1 : Create a non-root user account for local admin access

Hardening-security

Guideline IDESXi.create-local-admin

Vulnerability Discussion : By default each ESXi host has a single “root” admin account that is used for local administration and to connect the host to vCenter Server.  To avoid sharing a common root account it is recommended on each host to create at least one named user account and assign it full admin privileges and to use  this account in lieu of a shared “root” account.  Set a highly complex password for the “root” account and secure it in a safe location.  Limit the use of “root” but do not remove the “root” account.

Risk Read The Rest ......