Security Hardening on ESXi, not esx?

[Inmedius]

First of all, is this the right place? I found a bunch of KB articles on security hardening (password policies, account lock out policies) but they all point to esx. We have ESXi 4.1 / 5 and it seems this command "esxcfg-auth" does not exist in ESXi. So my question is

1) How can I enfore a password maximum age (force to change after xxx days)

2) Editing the /etc/pam.d/system-auth would set the complexity correct?

Thanks!

[Troy_Clavell]

Hello and Welcome to the Forums!

Your thread has been moved from the VMware Knowledge Base  Community to the Security and Compliance Community

[Inmedius]

thanks! Didnt see that forum

[MaxBeard]

Hello Inmedius,

I'm not sure about your first question, but second answer can be found here: ESX and ESXi 4.x and 5.x password requirements and restrictions

Keep in mind, that there is a problem with editing /etc/pam.d/system-auth file in ESXi4.1u1. Check this comment to details

Note: I think you know, but just in case: VMware vSphere 4.1 Security Hardening Guide doesn't contain any requirements for password age in ESXi. It describes requirements only for ESX console.

[Texiwill]

Hello,

ESXi 4.1 and 5.0 do have increased capabilities within the management appliance for security controls, and if those controls exist as they do in this case, they should be enforced. In this case you would need to edit the system-auth file directly, then on ESXi 4.1 on reboot copy that file back over from somewhere. You can use an Alert in vCenter to run a script that performs the vifs vCLI command to copy files over to ESXi on boot. A bit clunky but it will work. Even so, perhaps the control should be implemented some other way.

Yet if the security control disappears during a reboot, the security control should still be enforced. However, more to the point, the only time you should be logging into the ESXi console is a break glass event such as a catastrophic failure, and as such you will most likely use the root user. That is not a user you want to chage upon. However, you do want to change its password periodically and the password vaulting tools that are out there from Reflex Systems and HyTrust will manage this for you.

If it was me, I would not add any users to ESXi directly, thereby moving the problem to just the maintenance of the root user. Then apply the same control you are trying to do by using a password vaulting system that will automatically update/modify the password.

Best regards,
Edward L. Haletky
VMware Communities User Moderator, VMware vExpert 2009, 2010, 2011

Author of the books 'VMWare ESX and ESXi in the Enterprise: Planning Deployment Virtualization Servers', Copyright 2011 Pearson Education. 'VMware vSphere and Virtual Infrastructure Security: Securing the Virtual Environment', Copyright 2009 Pearson Education.
vSphere Upgrade Saga -- Virtualization Security Round Table Podcast