vSphere 6.5 Security Configuration Guide (née Hardening Guide) Release Candidate

[mikefoley]

Attached is the Release Candidate of the vSphere 6.5 Security Configuration Guide. Yes, it's no longer called the "Hardening Guide" because only a subset of it is actual "hardening".

I'm about to post a blog article on this release at https://blogs.vmware.com/vsphere that explains in more detail. This post is a landing spot for the guide so folks can download it. We have the GA version next week and at that time it will get uploaded to its regular home.

Please post your feedback here or as a reply to the blog. As I mentioned, I'm looking to have the GA version next Thursday (April 13th).

mike

[Update 14 April 2017] The GA of the guide is now available at Security Hardening Guides - VMware Security

Message was edited by: mikefoley

[jcporsche]

HI Mike,

What were the basis for the security config guide, did you follow some directives, guidance ?

Thanks for the time

[mikefoley]

The guide has been around for around a decade and Pre-dates directives such as PCI. In fact, most PCI, HIPAA & DISA type directives use this guide as the basis for their requirements. This guide would be considered "vendor best practices" or something similar.

[goodgrief]

Hi,

Applying guide settings but found a typo under heading Vulnerability Discussion for Guideline ID "VM.Enable-VGA-Only-Mode". The description is taken from the previous 3 settings "VM.disconnect-devices-serial" etc. IT starts "Ensure that no device is connected to a virtual machine if it is not required" but doesn't describe why VGA only should be used.

Thanks

Michael.

[mikefoley]

Thanks for catching this. I'll update the vulnerability discussion and it will come out in the next update of the guide.

The updated Vulnerability Discussion will be:

Many Server-class virtual machines need only a standard VGA console (typically a Unix/Linux server system). Enabling this setting removes additional unnecessary (for a server workload)  functionality beyond disabling 3D.

Thanks again,

mike

[kevinstiegler]

Post hardening, what NESSUS Audit Profiles are we running against the 6.5 architecture to ensure it is meeting compliance?

[vXav]

Hi Mike,

In vRops 6.7 I get the "ESXi.config-ntp - NTP firewall rule is not configured" alert because the firewall of the NTP service is set to allow "ALL".

vRops 6.7 security compliance "ESXi.config-ntp - NTP firewall rule is not configured"

Though I can't find a mention to this anywhere in the security guide. Do you have some extra info about it? What's recommended and what's not?

Cheers,

[edit] By the way in the SCG the default value of Security.AccountLockFailures is set to 10. The value in a fresh ESXi 6.5 install is 5.