ESX Configuration Guide

Table 14-3. Default setgid Applications

Application	Purpose and Path	Required or Optional
wall	Alerts all terminals that an action is about to occur. This	Optional
	application is called by shutdown and other commands.
	Path: /usr/bin/wall
lockfile	Performs locking for the Dell OM management agent.	Required for Dell OM
	Path: /usr/bin/lockfile	but optional otherwise

SSH Security

SSH is a commonly used Unix and Linux command shell that lets you remotely log in to the service console and perform certain management and configuration tasks for the host. SSH is used for secure logins and data transfers because it offers stronger protection than other command shells.

In this ESX release, the SSH configuration is enhanced to provide a higher security level. This enhancement includes the following key features.

nVersion 1 SSH protocol disabled – VMware no longer supports Version 1 SSH protocol and uses Version 2 protocol exclusively. Version 2 eliminates certain security issues present in Version 1 and provides you with a safer communications interface to the service console.

nImproved cipher strength – SSH now supports only 256-bit and 128-bit AES ciphers for your connections.

nLimits on remote logins as root – You can no longer remotely log in as root. Instead, you log in as an identifiable user and either use the sudo command to run specific operations that require root privileges or enter the su command to become the root user.

NOTE The sudo command provides security benefits in that it limits root activities and helps you check for possible misuse of root privileges by generating an audit trail of any root activities that the user performs.

These settings are designed to provide solid protection for the data you transmit to the service console through SSH. If this configuration is too rigid for your needs, you can lower security parameters.

Change the Default SSH Configuration

You can change the default SSH configuration.

Procedure

1 Log in to the service console and acquire root privileges.

2Change to the /etc/ssh directory.

3Use a text editor to perform any of the following actions in the sshd_config file.

nTo allow remote root login, change the setting to yes in the following line.

PermitRootLogin no

nTo revert to the default SSH protocol (Version 1 and 2), comment out the following line.

Protocol 2

nTo revert to the 3DES cipher and other ciphers, comment out the following line.

Ciphers aes256-cbc,aes128-cbc

nTo disable Secure FTP (SFTP) on SSH, comment out the following line.

Subsystem ftp /usr/libexec/openssh/sftp-server

204	VMware, Inc.