VMware vSphere Security Hardening Report (ENTERPRISE) --- Date: 01-29-2010 20:39:48


Grade: 10% F

COS Report Check- http://communities.vmware.com/docs/DOC-1184813 total checksPASS - 7.7 %FAIL - 0 %REQUIRE MANUAL VALIDATION - 92.3 %
EntityCodeDescriptionStatusResolution/Fix
himalaya.primp-industries.comCON01Ensure ESX Firewall is configured to High SecurityPASSN/A
himalaya.primp-industries.comCON02Limit network access to applications and servicesMANUALesxcfg-firewall --query to query for running services
himalaya.primp-industries.comCOM01Do not apply Red Hat patches to the Service ConsoleMANUALApply only patches published by VMware & follow http://www.vmware.com/security
himalaya.primp-industries.comCOM02Do not rely upon tools that only check for Red Hat patchesMANUALUse scanners specifically for ESX Service Console (COS)
himalaya.primp-industries.comCOM03Do Not Manage the Service Console as a Red Hat Linux HostMANUALManage Service Console with only vmkfstools & esxcfg-* commands
himalaya.primp-industries.comCOM04Use vSphere Client and vCenter to Administer the Hosts Instead of Service ConsoleMANUALUse vSphere APIs whenever possible for security policies & processes
himalaya.primp-industries.comCOP01Use a Directory Service for AuthenticationMANUALesxcfg-auth to configure directory services - http://www.vmware.com/vmtn/resources/582
himalaya.primp-industries.comCOL01Configure syslog loggingMANUALPlease refer to COS document for detail instructions
himalaya.primp-industries.comCOL02Configure NTP time synchronizationMANUALPlease refer to COS document for detail instructions
himalaya.primp-industries.comCOH01Partition the disk to prevent the root file system from filling upMANUALPlease refer to http://pubs.vmware.com/vsp40u1/install/c_esx_partitioning.html# 1_9_18_1
himalaya.primp-industries.comCOA03Ensure root access via SSH is disabledMANUAL"PermitRootLogin" in the /etc/sshd_conf should be setto "no"
himalaya.primp-industries.comCOA05Limit access to the su commandMANUALConfigure PAM module /etc/pam.d/su
himalaya.primp-industries.comCOA06Configure and use sudo to control administrative accessMANUALEnsure access to commands are controled and configured properly in /etc/sudoers

HOST Report Check- http://communities.vmware.com/docs/DOC-1184511 total checksPASS - 9.1 %FAIL - 45.5 %REQUIRE MANUAL VALIDATION - 36.4 %
EntityCodeDescriptionStatusResolution/Fix
himalaya.primp-industries.comHIN01Verify integrity of software before installationMANUALVerify SHA1 hash after downloading from VMware
himalaya.primp-industries.comHCM01Configure Encryption for ESX/ESXi CommunicationFAILVMware default SSL cert should not be used
himalaya.primp-industries.comHCM01Configure Encryption for ESX/ESXi CommunicationFAILproxy.xml for SSL should contain readTimeoutsMs and/or handshakeTimeoutMs
himalaya.primp-industries.comHCM04Ensure ESX is Configured to Encrypt All SessionsFAIL<httpPort/> in proxy.xml should not be configured to allow HTTP
himalaya.primp-industries.comHCM04Ensure ESX is Configured to Encrypt All SessionsFAIL<accessMode/> in proxy.xml should not be configured to allow HTTP
himalaya.primp-industries.comHLG01Configure remote syslogFAILRemote syslog should be configured
himalaya.primp-industries.comHLG02Configure persistent loggingMANUALPlease refer to HOST doc for further details
himalaya.primp-industries.comHLG03Configure NTP time synchronizationPASSN/A
himalaya.primp-industries.comHMT01Control access by CIM-based hardware monitoring toolsMANUALPlease refer to the HOST doc for further details
himalaya.primp-industries.comHCN01Ensure only authorized users have access to the DCUIMANUALCheck the users in the local group named localadmin
himalaya.primp-industries.comHCN03Avoid adding the root user to local groupsWIPLockdown mode is not enabled

VM Report Check- http://communities.vmware.com/docs/DOC-1184424 total checksPASS - 0 %FAIL - 54.2 %REQUIRE MANUAL VALIDATION - 45.8 %
EntityCodeDescriptionStatusResolution/Fix
William-XPVMX01Prevent Virtual Disk ShrinkingFAILisolation.tools.diskWiper.disable and/or isolation.tools.diskShrink.disable should be configured to be disable
William-XPVMX01Prevent Virtual Disk ShrinkingFAILisolation.tools.diskWiper.disable and/or isolation.tools.diskShrink.disable should be configured to be disable
William-XPVMX03Disable Copy/Paste to Remote ConsoleFAILisolation.tools.copy.disable,isolation.tools.paste.disable,isolation.tools.setGUIOptions.enable should be configured to be disabled
William-XPVMX03Disable Copy/Paste to Remote ConsoleFAILisolation.tools.copy.disable,isolation.tools.paste.disable,isolation.tools.setGUIOptions.enable should be configured to be disabled
William-XPVMX03Disable Copy/Paste to Remote ConsoleFAILisolation.tools.copy.disable,isolation.tools.paste.disable,isolation.tools.setGUIOptions.enable should be configured to be disabled
William-XPVMX10Ensure Unauthorized Devices are Not ConnectedMANUALPlease refer to VM doc for further details
William-XPVMX11Prevent Unauthorized Removal or Connection of DevicesFAILisolation.device.connectable.disable and/or isolation.device.edit.disable should be configured to be disabled
William-XPVMX11Prevent Unauthorized Removal or Connection of DevicesFAILisolation.device.connectable.disable and/or isolation.device.edit.disable should be configured to be disabled
William-XPVMX12Disable VM to VM communication through VMCIFAILVMCI should not have unrestricted access
William-XPVMX20VM log file size and number should be limitedFAILVM logging is not configured sufficently
William-XPVMX20VM log file size and number should be limitedFAILVM logging is not configured sufficently
William-XPVMX21Limit informational messages from the VM to the VMX fileFAILtools.setInfo.sizeLimit should be limited to 1MB of output
William-XPVMX30Disable remote operations within the guestFAILVIX API commands to guest should be disabled
William-XPVMX31Do not send host performance information to guestsFAILHost performance should not be sent to guest VMs
William-XPVMX50Disable VMsafe CPU/Mem APIsMANUALPlease refer to VM doc for further details
William-XPVMX51Restrict access to VMsafe CPU/Mem APIsMANUALPlease refer to VM doc for further details
William-XPVMX52Prevent VM from being access through VMsafe CPU/Mem APIMANUALPlease refer to VM doc for further details
William-XPVMX53Disable VMsafe Network APIsMANUALPlease refer to VM doc for further details
William-XPVMX54Restrict access to VMsafe Network APIsMANUALPlease refer to VM doc for further details
William-XPVMX55Prevent VM from being access through VMsafe Network APIMANUALPlease refer to VM doc for further details
William-XPVMP01Secure Virtual Machines as You Would Secure Physical MachinesMANUALPlease refer to VM doc for further details
William-XPVMP02Disable Unnecessary or Superfluous FunctionsMANUALPlease refer to VM doc for further details
William-XPVMP03Use Templates to deploy VMs whenever possibleMANUALPlease refer to VM doc for further details
William-XPVMP05Minimize Use of the VM ConsoleMANUALPlease refer to VM doc for further details

VNETWORK Report Check- http://communities.vmware.com/docs/DOC-1184613 total checksPASS - 0 %FAIL - 7.7 %REQUIRE MANUAL VALIDATION - 92.3 %
EntityCodeDescriptionStatusResolution/Fix
himalaya.primp-industries.comNAR01Ensure management traffic is on a restricted networkMANUALPlease refer to the vNetwork Doc for further details
himalaya.primp-industries.comNAR02Ensure VMotion Traffic is isolatedMANUALPlease refer to the vNetwork Doc for further details
himalaya.primp-industries.comNAR03Ensure IP Based Storage Traffic is isolatedMANUALPlease refer to the vNetwork Doc for further details
himalaya.primp-industries.comNAR04Strictly control access to Management networkMANUALPlease refer to the vNetwork Doc for further details
himalaya.primp-industries.comNCN01Ensure that there are no unused port groups on standard vSwitchesFAILPortgroup: tempTrunkPassThrough is not being used by any VMs
himalaya.primp-industries.comNCN06Ensure that port groups are not configured to VLAN1 or the native VLANMANUALPlease refer to vNetwork doc for further details
himalaya.primp-industries.comNCN07Ensure that Port Groups are Configured with a clearnetwork labelMANUALClearly label your portgroups along with identifer to specify functionality
himalaya.primp-industries.comNCN08Ensure that all vSwitches have a clear network labelMANUALClearly label your vSwitches
himalaya.primp-industries.comNCN09Fully document all VLANs used on vSwitchesMANUALDocument all VLANs on vSwitches
himalaya.primp-industries.comNCN10Ensure that only authorized administrators have access to virtual networking componentsMANUALEnsure authorized admins have access
himalaya.primp-industries.comNPN01Ensure physical switch ports are configured with spanning tree disabledMANUALDisable spanning tree on physical switches
himalaya.primp-industries.comNPN02Ensure that the non-negotiate option is configured for trunk links between external physical switches and virtual switches in VST modeMANUALPlease refer to vNetwork doc for further details
himalaya.primp-industries.comNPN03VLAN trunk links must be connected only to physical switch ports that function as trunk linksMANUALSelf explanatory



Author: William Lam
Generated using: vGhetto Script Repository
™Primp Industries