Service Console Security

14

VMware has basic security recommendations for using the service console, including how to use some of the service console’s built-in security features. The service console is a management interface to ESX and, as such, its security is critical. To protect the service console against unauthorized intrusion and misuse, VMware imposes constraints on several service console parameters, settings, and activities.

This chapter includes the following topics:

n“General Security Recommendations,” on page 191

n“Log In to the Service Console,” on page 192

n“Service Console Firewall Configuration,” on page 192

n“Password Restrictions,” on page 196

n“Cipher Strength,” on page 201

n“setuid and setgid Flags,” on page 202

n“SSH Security,” on page 204

n“Security Patches and Security Vulnerability Scanning Software,” on page 205

General Security Recommendations

To protect the service console against unauthorized intrusion and misuse, VMware imposes constraints on several service console parameters, settings, and activities. You can loosen the constraints to meet your configuration needs, but if you do so, make sure that you are working in a trusted environment and have taken enough other security measures to protect the network as a whole and the devices connected to the ESX host.

Consider the following recommendations when evaluating service console security and administering the service console.

nLimit user access.

To improve security, restrict user access to the service console and enforce access security policies like setting up password restrictions—for example, character length, password aging limits, and using a grub password for booting the host.

The service console has privileged access to certain parts of ESX. Therefore, provide only trusted users with login access. By default, root access is limited by not allowing secure shell (SSH) login as the root user. Strongly consider keeping this default. Require ESX system administrators to log in as regular users and then use the sudo command to perform specific tasks that require root privileges.

Also, try to run as few processes on the service console as possible. Ideally, strive to run only the essential processes, services, and agents such as virus checkers, virtual machine backups, and so forth.

nUse vSphere Client to administer your ESX hosts.

VMware, Inc.

191