ESXi Hardening - Disable ICMP / HTTP

[Felix001]

Due to ESXi not having any built in firewall, and that I have to put this in a internet facing network in a Data Centre, i need to lock down the box.

I needto find out how to ....

1. Disable incoming Pings

2. Disable HTTP (and poss HTTPS or would this effect connecting to port 443)

3. Configure PAM to block SSH connect on 3 failed attempts.

4. Confirm what tcp/427 is for.

Thanks in advance for any help that anyone can provide with this.....

[nick_couchman]

I don't know of a way to do this. HTTP and HTTPS support could probably be disabled, but most operating systems require a firewall to block ICMP access - there isn't any real way to disable it. I'm not sure exactly how to modify the firewall ruleset on ESXi.

PAM support in ESXi is pretty limited - the modules you have there are the ones you get, so if you can't do it with what's included, I'm not sure if there's a way to do it at all.

Finally, 427 is known in services as srvloc - commonly known as SLP. It's a common protocol used in advertising and locating services on a LAN - similar to Apple's Bonjour/MDNS system.

[Dave_Mishchenko]

For item two you can see this page and try the httpsOnly option - http://www.vm-help.com/esx/esx3i/http_transfers.php. You should also look at port 902 (legacy VI client connections) and 5989 (CIM server - you can disable this in advanced settings in the health status tab is not essential to you).

[DSTAVERT]

I have used a physical firewall to protect the management network. I have two switches with VMs on one and the management network on the other. The management network also has NFS shares and other management VMs (monitoring etc.) A VPN gets me connected to the management network. Works quite well.

[cah220]

A question about PAM on ESXi. Is there anything that would keep one from building pam modules on another box and using them on the ESXi host? The only difficulty that I can see here is having the correct libc versions, etc.

[dtalk]

Well, someone has to say it, so I will: the answer to the ssh problem is "don't use it". The first rule of securing a computer is to reduce your attack surface. This is particularly true in this case; I would certainly not publicly expose a service that is explicitly "unsupported".

Learn to use the RCLI: I have yet to find anything important that I can't accomplish that way, though it isn't always straightforward, is rough around the edges, and does take some reading of the manual.

You might also take a look here; I found it helpful: http://searchvmware.techtarget.com/tip/0,289483,sid179_gci1340015,00.html?track=NL-915&ad=675974&asr...

Cheers -d

[nick_couchman]

It's a little more difficult than that...you'll probably want to start my grabbing the GPL sources from the VMware VI3 Download page. This has header files needed to compile software correctly for ESX and ESXi. I'm still not sure that it has all of the header files you need, but it's a good start.