Welcome back to part 2 of our discussion of the vSphere 5.0 Hardening Guide! If you missed part 1, you can find it <a href="http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1">here</a>. Let's get back to it!
<ul>
	<li>Guideline Title: Communication Configure the ESXi host firewall to restrict access to services running on the host
<ul>
	<li>Title: config-firewall-access</li>
	<li>Discussion: The process of hardening a production server involves stopping unnecessary services and protecting services that need to remain running, and ESXi is no different. Unnecessary services should be disabled. Necessary services can be protected at the From the vSphere client, select each host and go to "Configuration -&gt; Security Profile". In the "Firewall" section select "Properties". For each enabled service, (e.g. ssh, vSphere Web Access, http client), select "Firewall", select "Only allow connections from the following networks" and provide a range of authorized IP addresses.<img class="alignnone size-medium wp-image-6918" src="http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall-300x189.png" alt="" width="300" height="189" /></li>
	<li><a href="http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-DD4322FF-3DC4-4716-8819-6688938F99D7.html">Official VMware Documentation</a></li>
</ul>
</li>
	<li>config-ntp vSphere 5.0 ESXI Communication Configure NTP time synchronization By ensuring that all systems use the same relative time source (including the relevant localization offset), and that the relative time source can be correlated to an agreed-upon time standard (such as Coordinated Universal Time—UTC), you can make it simpler to track and correlate an intruder’s actions when reviewing the relevant log files. Incorrect time settings can make it difficult to inspect and correlate log files to detect attacks, and can make auditing inaccurate. 1,2,3 Parameter From the vSphere Client: Select the host and click "Configuration -&gt; Time Configuration". Select the properties link and chose 'Options'. From the General tab start the NTP service and select "Start and stop with host". From the NTP Settings tab click the ' Add' button to add the site specific NTP servers. NTP can also be configured using the vCLI or PowerCLI. It is recommended to synchronize the ESXi clock with a time server that is located on the management network rather than directly with a time server on a public network. This time server can then synchronize with a public source through a strictly controlled network connection with a firewall. Note: Verify the required firewall ports are open. /etc/ntp.conf N/A Site Specific Modify No http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_networks.11.8.html</li>
	<li>config-snmp vSphere 5.0 ESXI Communication Ensure proper SNMP configuration If SNMP is not being used, it should remain disabled. If it is being used, the proper trap destination should be configured. If SNMP is not properly configured, monitoring information can be sent to a malicious host that can then use this information to plan an attack. 1,2,3 Parameter Run "vicfg-snmp &lt;conn_options&gt; --show" to determine if SNMP is being used. If SNMP is not being used, make sure that it is not running: "vicfg-snmp &lt;conn_options&gt; --disable&gt;. If SNMP is being used, refer to the vSphere Command-Line Interface Concepts and Examples guide, Chapter 10 for steps to make sure the parameters are properly configured. SNMP must be configured on each ESXi host using either vCLI or PowerCLI, or using an API client. /etc/vmware/snmp.xml N/A site-specific Modify N/A http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.monitoring.doc_50/GUID-8EF36D7D-59B6-4C74-B1AA-4A9D18AB6250.html</li>
	<li>disable-mob vSphere 5.0 ESXI Communication Disable Managed Object Browser (MOB) The managed object browser (MOB) provides a way to explore the object model used by the VMkernel to manage the host; it enables configurations to be changed as well. This interface is meant to be used primarily for debugging the vSphere SDK but because there are no access controls it could also be used as a method obtain information about a host being targeted for unauthorized access. 1,2,3 Parameter To determine if the MOB is enabled run the following command on the ESXi shell: ~# vim-cmd proxysvc/service_list. To disable the MOB run the following command: ~# vim-cmd proxysvc/remove_service "/mob" "httpsWithRedirect". Note: You cannot disable MOB while in lockdown mode. N/A N/A Remove Service Remove No The MOB will no longer be available for diagnostics. Some 3rd party tools use this interface to gather information. Testing should be done after disabling the MOB to verify 3rd party applications are still functioning as expected. To re-enable the MOB: ~ # vim-cmd proxysvc/add_np_service "/mob" httpsWithRedirect /var/run/vmware/proxy-mob http://kb.vmware.com/kb/1016039</li>
	<li>enable-auth-proxy vSphere 5.0 ESXI Communication When adding ESXi hosts to Active Directory use the vSphere Authentication Proxy to protect passwords If you configure your host to join an Active Directory domain using host profiles, the passwords used to authenticate the host are not protected. To avoid transmitting clear text passwords use the vSphere Authentication Proxy to configure hosts in Active Directory. 1,2,3 Parameter From the vSphere client home page select "Host Profiles". Right click the Host Profile and select Edit. Choose "Authentication configuration -&gt; Active Directory Configuration -&gt; Join Domain Method". Set the Join Domain Method to "Use vSphere Authentication Proxy to add the host to domain". N/A N/A Site Specific Modify No http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-084B74BD-40A5-4A4B-A82C-0C9912D580DC.html</li>
</ul>