Home
Security Hardening
CIS VMware ESXi 5.1 V1.0.1 L1

CIS VMware ESXi 5.1 V1.0.1 L1

Set a timeout to automatically terminate idle ESXi Shell and SSH sessions
Details http://pubs.vmware.com/vsphere-51/topic/com.vmware.vsphere.security.doc/GUID-A1D310D7-F00B-4827-9469-EC2C318A0C30.html Solution From the vSphere web client-1. Select the host.2. Click ‘Manage’ -> ‘Advanced System Settings’.3. Type ESXiShellInteractiveTimeOut in...
Set DCUI.Access to allow trusted users to override lockdown mode
Details Create a list of highly trusted users that would be able to override lockdown mode and access the DCUI...
Use Active Directory for local user authentication – Enabled = ‘true’
Details http://pubs.vmware.com/vsphere-51/topic/com.vmware.vsphere.security.doc/GUID-A61A8FA4-A4AF-475C-860E-3FD8947F0D0B.html Solution From the vSphere Web Client-1. Select the host and go to ‘Manage’ -> ‘Authentication Services’ and click...
Use Active Directory for local user authentication – Review Domain
Details http://pubs.vmware.com/vsphere-51/topic/com.vmware.vsphere.security.doc/GUID-A61A8FA4-A4AF-475C-860E-3FD8947F0D0B.html Solution From the vSphere Web Client-1. Select the host and go to ‘Manage’ -> ‘Authentication Services’ and click...
Verify Active Directory group membership for the ‘ESX Admins’ group
Details The AD group used by vSphere is defined by the esxAdminsGroup attribute. By default, this attribute is set to...
Verify Image Profile and VIB Acceptance Levels
Details The ESXi Image Profiles supports four VIB acceptance levels. A VIB (vSphere Installation Bundle) is a collection of files...
Verify no unauthorized kernel modules are loaded on the host
Details http://kb.vmware.com/kb/2042473 Solution To implement the recommended configuration state, run the following PowerCLIcommand-# To disable a module-$ESXCli = Get-EsxCli -VMHost...
Verify that the autoexpand option for VDS dvPortgroups is disabled
Details http://kb.vmware.com/kb/1022312 Solution 1. Connect to the vCenter Server using the Web Client.2. Open the settings for Networking > (vDS...
When adding ESXi hosts to Active Directory use the vSphere Authentication Proxy to protect passwords
Details If you are using Host Profiles to join ESXi hosts to Active Directory then vSphere Authentication Proxy should be...

CIS VMware ESXi 5.1 V1.0.1 L1

Set a timeout to automatically terminate idle ESXi Shell and SSH sessions

Set DCUI.Access to allow trusted users to override lockdown mode

Use Active Directory for local user authentication – Enabled = ‘true’

Use Active Directory for local user authentication – Review Domain

Verify Active Directory group membership for the ‘ESX Admins’ group

Verify Image Profile and VIB Acceptance Levels

Verify no unauthorized kernel modules are loaded on the host

Verify that the autoexpand option for VDS dvPortgroups is disabled

When adding ESXi hosts to Active Directory use the vSphere Authentication Proxy to protect passwords