(6810,35,'2012-06-12 03:16:42','2012-06-12 03:16:42','The VMware View dashboard doesn\'t offer a built-in way to schedule a desktop pool refresh. As an administrator, you\'ll often want to schedule these types of activities for after business hours or during maintenance windows. Here\'s a PowerCLI script that lets you schedule VMware View pool refreshes on a one-time or periodic basis.<!--more-->\r\n\r\nHere\'s the whole script. Lines are marked with a number and parenthesis to avoid confusion with text wrapping.\r\n<pre>1) Add-PSSnapin VMware.View.Broker\r\n2) Connect-VIServer &lt;your View Connection Server hostname&gt;\r\n3) $a = get-date ((get-date).AddMinutes(2)) -format \"yyyy-MM-%d HH:mm\"\r\n4) Get-Pool -pool_id &lt;your pool ID&gt; | Get-DesktopVM | Send-LinkedCloneRefresh -schedule $a</pre>\r\nLet\'s step through each line of the script and dig into what it does. Since this is a Powershell script, the first line needs to import the VMware View snapins for Powershell.\r\n\r\nLine 2 logs the script in to your View Connection Server. To avoid saving a password in cleartext in the script, we\'ll have Windows store the credentials for the account this script will run as (more on that later).\r\n\r\nThe third line assigns the $a variable a time reference that is two minutes in the future. The specific formatting modifies the native Get-Date result into the time format that the next line is expecting. yyyy is a 4 digit year, MM is the numeric month with leading zeroes where appropriate, %d is the numeric day of the month without leading zeroes, HH is the hours in a 24-hour clock format, mm is the minutes past the hour. Be careful - almost all these tokens are case-sensitive (e.g. MM vs. mm).\r\n\r\nThe last line actually schedules the View Pool refresh for two minutes in the future using the variable we just built and formatted. You can find your View Pool ID listed in your View Connection Server.\r\n\r\nSave all this text in text file with a .ps1 extension to let the system know it\'s a Powershell script. Add a new task to Task Scheduler on your View Connection Server. You\'ll want this task to run with highest privileges and run as a user that has administrative rights to your View environment (this is why you don\'t have to specify credentials in the script). For the script action, the program to run is\r\n<pre>C:\\Windows\\system32\\WindowsPowershell\\v1.0\\powershell.exe</pre>\r\nand the optional argument is the path to your .ps1 script.\r\n<img class=\"alignnone size-full wp-image-6802\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/Screen-Shot-2012-06-11-at-10.28.36-PM.png\" alt=\"\" width=\"458\" height=\"493\" />','REFRESH YOUR VMWARE VIEW POOLS WITH POWERCLI','','inherit','open','open','','6794-revision-15','','','2012-06-12 03:16:42','2012-06-12 03:16:42','',6794,'http://egroup.jasonmangone.com/6794-revision-15',0,'revision','',0),(6811,35,'2012-06-12 03:16:44','2012-06-12 03:16:44','The VMware View dashboard doesn\'t offer a built-in way to schedule a desktop pool refresh. As an administrator, you\'ll often want to schedule these types of activities for after business hours or during maintenance windows. Here\'s a PowerCLI script that lets you schedule VMware View pool refreshes on a one-time or periodic basis.<!--more-->\r\n\r\nHere\'s the whole script. Lines are marked with a number and parenthesis to avoid confusion with text wrapping.\r\n<pre>1) Add-PSSnapin VMware.View.Broker\r\n2) Connect-VIServer &lt;your View Connection Server hostname&gt;\r\n3) $a = get-date ((get-date).AddMinutes(2)) -format \"yyyy-MM-%d HH:mm\"\r\n4) Get-Pool -pool_id &lt;your pool ID&gt; | Get-DesktopVM | Send-LinkedCloneRefresh -schedule $a</pre>\r\nLet\'s step through each line of the script and dig into what it does. Since this is a Powershell script, the first line needs to import the VMware View snapins for Powershell.\r\n\r\nLine 2 logs the script in to your View Connection Server. To avoid saving a password in cleartext in the script, we\'ll have Windows store the credentials for the account this script will run as (more on that later).\r\n\r\nThe third line assigns the $a variable a time reference that is two minutes in the future. The specific formatting modifies the native Get-Date result into the time format that the next line is expecting. yyyy is a 4 digit year, MM is the numeric month with leading zeroes where appropriate, %d is the numeric day of the month without leading zeroes, HH is the hours in a 24-hour clock format, mm is the minutes past the hour. Be careful - almost all these tokens are case-sensitive (e.g. MM vs. mm).\r\n\r\nThe last line actually schedules the View Pool refresh for two minutes in the future using the variable we just built and formatted. You can find your View Pool ID listed in your View Connection Server.\r\n\r\nSave all this text in text file with a .ps1 extension to let the system know it\'s a Powershell script. Add a new task to Task Scheduler on your View Connection Server. You\'ll want this task to run with highest privileges and run as a user that has administrative rights to your View environment (this is why you don\'t have to specify credentials in the script). For the script action, the program to run is\r\n<pre>C:\\Windows\\system32\\WindowsPowershell\\v1.0\\powershell.exe</pre>\r\nand the optional argument is the path to your .ps1 script.\r\n<img class=\"alignnone size-full wp-image-6802\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/Screen-Shot-2012-06-11-at-10.28.36-PM.png\" alt=\"\" width=\"458\" height=\"493\" />','REFRESH YOUR VMWARE VIEW POOLS WITH POWERCLI','','inherit','open','open','','6794-revision-16','','','2012-06-12 03:16:44','2012-06-12 03:16:44','',6794,'http://egroup.jasonmangone.com/6794-revision-16',0,'revision','',0),(6812,35,'2012-06-12 03:17:04','2012-06-12 03:17:04','The VMware View dashboard doesn\'t offer a built-in way to schedule a desktop pool refresh. As an administrator, you\'ll often want to schedule these types of activities for after business hours or during maintenance windows. Here\'s a PowerCLI script that lets you schedule VMware View pool refreshes on a one-time or periodic basis.<!--more-->\r\n\r\nHere\'s the whole script. Lines are marked with a number and parenthesis to avoid confusion with text wrapping.\r\n<pre>1) Add-PSSnapin VMware.View.Broker\r\n2) Connect-VIServer &lt;your View Connection Server hostname&gt;\r\n3) $a = get-date ((get-date).AddMinutes(2)) -format \"yyyy-MM-%d HH:mm\"\r\n4) Get-Pool -pool_id &lt;your pool ID&gt; | Get-DesktopVM | Send-LinkedCloneRefresh -schedule $a</pre>\r\nLet\'s step through each line of the script and dig into what it does. Since this is a Powershell script, the first line needs to import the VMware View snapins for Powershell.\r\n\r\nLine 2 logs the script in to your View Connection Server. To avoid saving a password in cleartext in the script, we\'ll have Windows store the credentials for the account this script will run as (more on that later).\r\n\r\nThe third line assigns the $a variable a time reference that is two minutes in the future. The specific formatting modifies the native Get-Date result into the time format that the next line is expecting. yyyy is a 4 digit year, MM is the numeric month with leading zeroes where appropriate, %d is the numeric day of the month without leading zeroes, HH is the hours in a 24-hour clock format, mm is the minutes past the hour. Be careful - almost all these tokens are case-sensitive (e.g. MM vs. mm).\r\n\r\nThe last line actually schedules the View Pool refresh for two minutes in the future using the variable we just built and formatted. You can find your View Pool ID listed in your View Connection Server.\r\n\r\nSave all this text in text file with a .ps1 extension to let the system know it\'s a Powershell script. Add a new task to Task Scheduler on your View Connection Server. You\'ll want this task to run with highest privileges and run as a user that has administrative rights to your View environment (this is why you don\'t have to specify credentials in the script). For the script action, the program to run is\r\n<pre>C:\\Windows\\system32\\WindowsPowershell\\v1.0\\powershell.exe</pre>\r\nand the optional argument is the path to your .ps1 script.\r\n<img class=\"alignnone size-full wp-image-6802\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/Screen-Shot-2012-06-11-at-10.28.36-PM.png\" alt=\"\" width=\"458\" height=\"493\" />','REFRESH YOUR VMWARE VIEW POOLS WITH POWERCLI','','inherit','open','open','','6794-revision-17','','','2012-06-12 03:17:04','2012-06-12 03:17:04','',6794,'http://egroup.jasonmangone.com/6794-revision-17',0,'revision','',0),(6813,35,'2012-06-12 03:17:06','2012-06-12 03:17:06','The VMware View dashboard doesn\'t offer a built-in way to schedule a desktop pool refresh. As an administrator, you\'ll often want to schedule these types of activities for after business hours or during maintenance windows. Here\'s a PowerCLI script that lets you schedule VMware View pool refreshes on a one-time or periodic basis.<!--more-->\r\n\r\nHere\'s the whole script. Lines are marked with a number and parenthesis to avoid confusion with text wrapping.\r\n<pre>1) Add-PSSnapin VMware.View.Broker\r\n2) Connect-VIServer &lt;your View Connection Server hostname&gt;\r\n3) $a = get-date ((get-date).AddMinutes(2)) -format \"yyyy-MM-%d HH:mm\"\r\n4) Get-Pool -pool_id &lt;your pool ID&gt; | Get-DesktopVM | Send-LinkedCloneRefresh -schedule $a</pre>\r\nLet\'s step through each line of the script and dig into what it does. Since this is a Powershell script, the first line needs to import the VMware View snapins for Powershell.\r\n\r\nLine 2 logs the script in to your View Connection Server. To avoid saving a password in cleartext in the script, we\'ll have Windows store the credentials for the account this script will run as (more on that later).\r\n\r\nThe third line assigns the $a variable a time reference that is two minutes in the future. The specific formatting modifies the native Get-Date result into the time format that the next line is expecting. yyyy is a 4 digit year, MM is the numeric month with leading zeroes where appropriate, %d is the numeric day of the month without leading zeroes, HH is the hours in a 24-hour clock format, mm is the minutes past the hour. Be careful - almost all these tokens are case-sensitive (e.g. MM vs. mm).\r\n\r\nThe last line actually schedules the View Pool refresh for two minutes in the future using the variable we just built and formatted. You can find your View Pool ID listed in your View Connection Server.\r\n\r\nSave all this text in text file with a .ps1 extension to let the system know it\'s a Powershell script. Add a new task to Task Scheduler on your View Connection Server. You\'ll want this task to run with highest privileges and run as a user that has administrative rights to your View environment (this is why you don\'t have to specify credentials in the script). For the script action, the program to run is\r\n<pre>C:\\Windows\\system32\\WindowsPowershell\\v1.0\\powershell.exe</pre>\r\nand the optional argument is the path to your .ps1 script.\r\n<img class=\"alignnone size-full wp-image-6802\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/Screen-Shot-2012-06-11-at-10.28.36-PM.png\" alt=\"\" width=\"458\" height=\"493\" />','REFRESH YOUR VMWARE VIEW POOLS WITH POWERCLI','','inherit','open','open','','6794-revision-18','','','2012-06-12 03:17:06','2012-06-12 03:17:06','',6794,'http://egroup.jasonmangone.com/6794-revision-18',0,'revision','',0),(6814,35,'2012-06-12 03:20:14','2012-06-12 03:20:14','The VMware View dashboard doesn\'t offer a built-in way to schedule a desktop pool refresh. As an administrator, you\'ll often want to schedule these types of activities for after business hours or during maintenance windows. Here\'s a PowerCLI script that lets you schedule VMware View pool refreshes on a one-time or periodic basis.<!--more-->\n\nHere\'s the whole script. Lines are marked with a number and parenthesis to avoid confusion with text wrapping.\n<pre>1) Add-PSSnapin VMware.View.Broker\n2) Connect-VIServer &lt;your View Connection Server hostname&gt;\n3) $a = get-date ((get-date).AddMinutes(2)) -format \"yyyy-MM-%d HH:mm\"\n4) Get-Pool -pool_id &lt;your pool ID&gt; | Get-DesktopVM | Send-LinkedCloneRefresh -schedule $a</pre>\nLet\'s step through each line of the script and dig into what it does. Since this is a Powershell script, the first line needs to import the VMware View snapins for Powershell.\n\nLine 2 logs the script in to your View Connection Server. To avoid saving a password in cleartext in the script, we\'ll have Windows store the credentials for the account this script will run as (more on that later).\n\nThe third line assigns the $a variable a time reference that is two minutes in the future. The specific formatting modifies the native Get-Date result into the time format that the next line is expecting. yyyy is a 4 digit year, MM is the numeric month with leading zeroes where appropriate, %d is the numeric day of the month without leading zeroes, HH is the hours in a 24-hour clock format, mm is the minutes past the hour. Be careful - almost all these tokens are case-sensitive (e.g. MM vs. mm).\n\nThe last line actually schedules the View Pool refresh for two minutes in the future using the variable we just built and formatted. You can find your View Pool ID listed in your View Connection Server.\n\nSave all this text in text file with a .ps1 extension to let the system know it\'s a Powershell script. Add a new task to Task Scheduler on your View Connection Server. You\'ll want this task to run with highest privileges and run as a user that has administrative rights to your View environment (this is why you don\'t have to specify credentials in the script). For the script action, the program to run is\n<pre>C:\\Windows\\system32\\WindowsPowershell\\v1.0\\powershell.exe</pre>\nand the optional argument is the path to your .ps1 script.\n<img class=\"alignnone size-full wp-image-6802\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/Screen-Shot-2012-06-11-at-10.28.36-PM.png\" alt=\"\" width=\"458\" height=\"493\" />','REFRESH YOUR VMWARE VIEW POOLS WITH POWERCLI','','inherit','open','open','','6794-autosave','','','2012-06-12 03:20:14','2012-06-12 03:20:14','',6794,'http://egroup.jasonmangone.com/6794-autosave',0,'revision','',0),(6816,2,'2012-06-14 14:17:47','2012-06-14 14:17:47','Each year the Greater Columbia Chamber of Commerce honors the best and brightest of the Midlands technology community at the <a href=\"http://www.columbiachamber.com/PPA.htm\">Palmetto Pillar Awards</a>. The Columbia Information Technology Council honors a number of technology leaders, innovators and IT executives for their outstanding vision, leadership and support of technology initiatives in the Midlands.\r\n\r\nNominees are honored in the following categories:\r\n<ul>\r\n	<li>One to Watch</li>\r\n	<li>Leadership in Technology</li>\r\n	<li>Public Service through IT</li>\r\n	<li>Start-up Venture</li>\r\n	<li>Technology in the Arts</li>\r\n	<li>Licensed IT Product</li>\r\n	<li>Custom Application Development</li>\r\n	<li>Cloud Services</li>\r\n	<li>IT Infrastructure Services</li>\r\n	<li>Student Achievement</li>\r\n</ul>\r\nNominations are free and open to the public. Top recipients will be honored at an awards banquet on Tuesday, August 21, 2012, at the Zone at Williams Brice Stadium.\r\n\r\nClick <a href=\"http://www.columbiachamber.com/PPA.htm\">here</a> to submit a nomination today!  Deadline is June 22.','CALL FOR NOMINATIONS: PALMETTO PILLAR AWARDS','','publish','open','open','','call-for-nominations-palmetto-pillar-awards','','','2012-06-15 14:49:51','2012-06-15 14:49:51','',0,'http://egroup.jasonmangone.com/?p=6816',0,'post','',0),(6817,2,'2012-06-14 14:17:20','2012-06-14 14:17:20','Each year the Greater Columbia Chamber of Commerce honors the best and brightest of the Midlands technology community at the <a href=\"http://www.columbiachamber.com/PPA.htm\">Palmetto Pillar Awards</a>. The Columbia Information Technology Council honors a number of technology leaders, innovators and IT executives for their outstanding vision, leadership and support of technology initiatives in the Midlands.\n\nNominations are free and open to the public. Top recipients will be honored at an awards banquet on Tuesday, August 21, 2012, at the Zone at Williams Brice Stadium.\n\nClick <a href=\"http://www.columbiachamber.com/PPA.htm\">here</a> to check out the categories and to submit a nomination today!','CALL FOR NOMINATIONS: PALMETTO PILLAR AWARDS','','inherit','open','open','','6816-revision','','','2012-06-14 14:17:20','2012-06-14 14:17:20','',6816,'http://egroup.jasonmangone.com/6816-revision',0,'revision','',0),(6818,2,'2012-06-14 14:17:47','2012-06-14 14:17:47','Each year the Greater Columbia Chamber of Commerce honors the best and brightest of the Midlands technology community at the <a href=\"http://www.columbiachamber.com/PPA.htm\">Palmetto Pillar Awards</a>. The Columbia Information Technology Council honors a number of technology leaders, innovators and IT executives for their outstanding vision, leadership and support of technology initiatives in the Midlands.\r\n\r\nNominations are free and open to the public. Top recipients will be honored at an awards banquet on Tuesday, August 21, 2012, at the Zone at Williams Brice Stadium.\r\n\r\nClick <a href=\"http://www.columbiachamber.com/PPA.htm\">here</a> to check out the categories and to submit a nomination today!','CALL FOR NOMINATIONS: PALMETTO PILLAR AWARDS','','inherit','open','open','','6816-revision-2','','','2012-06-14 14:17:47','2012-06-14 14:17:47','',6816,'http://egroup.jasonmangone.com/6816-revision-2',0,'revision','',0),(6819,2,'2012-06-14 14:23:08','2012-06-14 14:23:08','Each year the Greater Columbia Chamber of Commerce honors the best and brightest of the Midlands technology community at the <a href=\"http://www.columbiachamber.com/PPA.htm\">Palmetto Pillar Awards</a>. The Columbia Information Technology Council honors a number of technology leaders, innovators and IT executives for their outstanding vision, leadership and support of technology initiatives in the Midlands.\r\n\r\nNominees are honored in the following categories:\r\n<ul>\r\n	<li>One to Watch</li>\r\n	<li>Leadership in Technology</li>\r\n	<li>Public Service through IT</li>\r\n	<li>Start-up Venture</li>\r\n	<li>Technology in the Arts</li>\r\n	<li>Licensed IT Product</li>\r\n	<li>Custom Application Development</li>\r\n	<li>Cloud Services</li>\r\n	<li>IT Infrastructure Services</li>\r\n	<li>Student Achievement</li>\r\n</ul>\r\nNominations are free and open to the public. Top recipients will be honored at an awards banquet on Tuesday, August 21, 2012, at the Zone at Williams Brice Stadium.\r\n\r\nClick <a href=\"http://www.columbiachamber.com/PPA.htm\">here</a> to submit a nomination today!','CALL FOR NOMINATIONS: PALMETTO PILLAR AWARDS','','inherit','open','open','','6816-revision-3','','','2012-06-14 14:23:08','2012-06-14 14:23:08','',6816,'http://egroup.jasonmangone.com/6816-revision-3',0,'revision','',0),(6820,2,'2012-06-14 14:25:12','2012-06-14 14:25:12','Each year the Greater Columbia Chamber of Commerce honors the best and brightest of the Midlands technology community at the <a href=\"http://www.columbiachamber.com/PPA.htm\">Palmetto Pillar Awards</a>. The Columbia Information Technology Council honors a number of technology leaders, innovators and IT executives for their outstanding vision, leadership and support of technology initiatives in the Midlands.\n\nNominees are honored in the following categories:\n<ul>\n	<li>One to Watch</li>\n	<li>Leadership in Technology</li>\n	<li>Public Service through IT</li>\n	<li>Start-up Venture</li>\n	<li>Technology in the Arts</li>\n	<li>Licensed IT Product</li>\n	<li>Custom Application Development</li>\n	<li>Cloud Services</li>\n	<li>IT Infrastructure Services</li>\n	<li>Student Achievement</li>\n</ul>\nNominations are free and open to the public. Top recipients will be honored at an awards banquet on Tuesday, August 21, 2012, at the Zone at Williams Brice Stadium.\n\nClick <a href=\"http://www.columbiachamber.com/PPA.htm\">here</a> to submit a nomination today!','CALL FOR NOMINATIONS: PALMETTO PILLAR AWARDS','','inherit','open','open','','6816-autosave','','','2012-06-14 14:25:12','2012-06-14 14:25:12','',6816,'http://egroup.jasonmangone.com/6816-autosave',0,'revision','',0),(6821,2,'2012-06-14 14:24:05','2012-06-14 14:24:05','Each year the Greater Columbia Chamber of Commerce honors the best and brightest of the Midlands technology community at the <a href=\"http://www.columbiachamber.com/PPA.htm\">Palmetto Pillar Awards</a>. The Columbia Information Technology Council honors a number of technology leaders, innovators and IT executives for their outstanding vision, leadership and support of technology initiatives in the Midlands.\r\n\r\nNominees are honored in the following categories:\r\n<ul>\r\n	<li>One to Watch</li>\r\n	<li>Leadership in Technology</li>\r\n	<li>Public Service through IT</li>\r\n	<li>Start-up Venture</li>\r\n	<li>Technology in the Arts</li>\r\n	<li>Licensed IT Product</li>\r\n	<li>Custom Application Development</li>\r\n	<li>Cloud Services</li>\r\n	<li>IT Infrastructure Services</li>\r\n	<li>Student Achievement</li>\r\n</ul>\r\nNominations are free and open to the public. Top recipients will be honored at an awards banquet on Tuesday, August 21, 2012, at the Zone at Williams Brice Stadium.\r\n\r\nClick <a href=\"http://www.columbiachamber.com/PPA.htm\">here</a> to submit a nomination today!','CALL FOR NOMINATIONS: PALMETTO PILLAR AWARDS','','inherit','open','open','','6816-revision-4','','','2012-06-14 14:24:05','2012-06-14 14:24:05','',6816,'http://egroup.jasonmangone.com/6816-revision-4',0,'revision','',0),(6824,44,'2012-06-16 14:39:47','2012-06-16 14:39:47','Some time now has passed since EMC World tore through Las Vegas and my head is still spinning from all the announcements! One that definitely should be overlooked especially for SMB customers is the newest addition to the VNXe family, the VNXe 3150. For those of you who are not familiar the VNXe line of storage from EMC let me get you up to speed. VNXe systems were designed with one philosophy in mind: keep it simple. It’s storage from the application’s point of view with one clear way to handle any task from initial installation to creating storage for virtual servers. You can shift from managing file shares to creating application storage without missing a beat.What this means to you? Well...You can save time and steps. Provisioning storage is a breeze most any opertaion you need to do can be lone in 5 clicks or less and most certainly under 10 minutes. Not too shabby huh? All of this is done through the all new Unisphere management interface tailored especially for the VNXe for administrators of all types. This system is easy for the first time storage user to the storage expert. The wizards in this thing are fantastic! Not a wizard fan and dont like being bound with their constraints? No problem all the advanced features are still there for the storage pros! Dont forget the best part though, the VNXe line provides deduplication, thin provisioning and conpression all for FREE, no extra licensing required for any of those features! So, all that said let me tell you what the VNXe 3150 brings to the table, more after the bump!<!--more-->\n\nThe new VNXe 3150 is a powerhouse in a tiny package for those who want the high performance and reliability that EMC is known for without the price tag of enterprise class storage. The new VNXe 3150 storage system, adds 50% more performance and capacity per rack unit with the simplicity for which the award-winning VNXe line is already known. This system like its older brothers is purpose-built for IT generalists and is optimized for cloud computing and virtualized applications, and this thing can pack a punch. In the newest 2U model the VNXe 3150 can now hold up to 25 2.5 inch drives in its enclosure, that\'s some serious terabytes per U! Did i mention it also now supports 3TB NL SAS drives as well? With all this space you wanna make sure the performance is there right? No problem, the new VNXe 3150 comes complete with Quad-Core Intel processors giving it the umph it needs and a 10 GB I/O module can be easily added to get the throughput you need from you storage in your environment!  Now I know you are wondering about the older brothers, are they getting left behind? Nope! They are getting upgrades as well especially in the drive area, all VNXe models will now be able to support 2.5 inch drives. I think we can all experct more announcements the second half of this year when the 3150 will be released. EMC has changed the face of the storage industy in many ways and had always provided good, healthy competition and I dont think we will see a slow down in that any time soon!','EMC WELCOMES A NEW MEMBER TO THE VNXe FAMILY','','inherit','open','open','','6823-revision','','','2012-06-16 14:39:47','2012-06-16 14:39:47','',6823,'http://egroup.jasonmangone.com/6823-revision',0,'revision','',0),(6825,44,'2012-06-16 14:43:11','2012-06-16 14:43:11','Some time now has passed since EMC World tore through Las Vegas and my head is still spinning from all the announcements! One that definitely should be overlooked especially for SMB customers is the newest addition to the VNXe family, the VNXe 3150. For those of you who are not familiar the VNXe line of storage from EMC let me get you up to speed. VNXe systems were designed with one philosophy in mind: keep it simple. It’s storage from the application’s point of view with one clear way to handle any task from initial installation to creating storage for virtual servers. You can shift from managing file shares to creating application storage without missing a beat. What this means to you? Well...You can save time and steps. Provisioning storage is a breeze most any operation you need to do can be lone in 5 clicks or less and most certainly under 10 minutes. Not too shabby huh? All of this is done through the all new Unisphere management interface tailored especially for the VNXe for administrators of all types. This system is easy for the first time storage user to the storage expert. The wizards in this thing are fantastic! Not a wizard fan and don\'t like being bound with their constraints? No problem all the advanced features are still there for the storage pros! Don\'t forget the best part though, the VNXe line provides deduplication, thin provisioning and compression all for FREE, no extra licensing required for any of those features! So, all of that said let me tell you what the VNXe 3150 brings to the table, more after the bump!<!--more-->\n\nThe new VNXe 3150 is a powerhouse in a tiny package for those who want the high performance and reliability that EMC is known for without the price tag of enterprise class storage. The new VNXe 3150 storage system, adds 50% more performance and capacity per rack unit with the simplicity for which the award-winning VNXe line is already known. This system like its older brothers is purpose-built for IT generalists and is optimized for cloud computing and virtualized applications, and this thing can pack a punch. In the newest 2U model the VNXe 3150 can now hold up to 25 2.5 inch drives in its enclosure, that\'s some serious terabytes per U! Did I mention it also now supports 3TB NL SAS drives as well? With all this space you wanna make sure the performance is there right? No problem, the new VNXe 3150 comes complete with Quad-Core Intel processors giving it the umph it needs and a 10 GB I/O module can be easily added to get the throughput you need from you storage in your environment!  Now I know you are wondering about the older brothers, are they getting left behind? Nope! They are getting upgrades as well especially in the drive area, all VNXe models will now be able to support 2.5 inch drives. I think we can all expect more announcements the second half of this year when the 3150 will be released. EMC has changed the face of the storage industry in many ways and has always provided good, healthy competition and I dont think we will see a slow down in that any time soon!','EMC WELCOMES A NEW MEMBER TO THE VNXe FAMILY','','inherit','open','open','','6823-revision-2','','','2012-06-16 14:43:11','2012-06-16 14:43:11','',6823,'http://egroup.jasonmangone.com/6823-revision-2',0,'revision','',0),(6826,44,'2012-06-20 20:22:32','2012-06-20 20:22:32','So Citrix Synergy has wrapped up in San Francisco and all the news is still buzzing around. Citrix showcased many new initiatives and products and intend to touch on a very specific one here... We\'ll maybe a couple because of the integration it brings. Question for you guys. How many laptops, phones, iPad\'s, etc., do you think were running around at this conference? My guess hundreds of thousands easily, expand that to all of San Francisco and it\'s easily millions. Mobile data and even more so the mobile workforce is everywhere! The days of sitting in your cube all day has passed. People want their data and applications everywhere they go. Which raises a question... How the heck do we get all these different devices to have all of our data and applications all the time and actually function? That\'s a good question, read more to find out!<!--more-->\r\n\r\nCitrix has had a solution for some time now called CloudGateway. Straight from Citrix\'s website its description is as follows...\r\n\r\n<em>Citrix CloudGateway is an enterprise mobility management solution that aggregates, controls and delivers Windows, web, SaaS and mobile apps, and data, to any device, anywhere. CloudGateway provides end-users with a unified single point of access and self-service to all of their business apps on any device anywhere. It also provides IT with a comprehensive single point of aggregation and control for all apps, data, devices and identities.</em>\r\n\r\nThat\'s a great description and I couldn\'t have said it better myself, to put it simply... Citrix gets you your stuff where you want it! Well almost, with all the devices out there, web browsers, and everything else to deal with it has been truly difficult to get every single device on board. Citrix has been actively working to change all of that and announced at Synergy this year CloudGateway 2. CloudGateway is packed full of goodness, but the big point for me? True mobility! Citrix CloudGateway 2 is an amazingly powerful update to its enterprise mobility solution that adds extensive mobile application management capabilities, including full support for native HTML 5, iOS and Android apps. This update hooks almost all devices out there, in short they have created a monster! By utilizing the CloudGateway StoreFront you can now get to your applications from any device but what about your data? No problem! CloudGateway 2 now integrates with Citrix Sharefile. If you guys don\'t know about this product do yourself and favor and check it out <a href=\"http://www.citrix.com/english/ps2/products/product.asp?contentid=2320956\" target=\"_blank\">here</a>. Sharefile is a fantastic product allowing you to securely share your data with anyone, anywhere on any device. Do we see a trend here? Anywhere, anyone, any device. It\'s the future folks and it is here, CloudGateway 2 is here and will pave the way for your \"Corporate Mobile Revolution\". This is your easy button to the cloud, by using CloudGateway, you are able to handle all your devices through the Storefront, access and share data through Sharefile and run your application with XenApp and all of this coupled together with the Citrix Receiver. If you aren\'t utilizing the Citrix Receiver and you are a Citrix environment then shame on you! You are missing out, make sure you download it from your app store or market or whatever you use on whatever device you have! CloudGateway 2 should hit the streets in July so keep an eye out and make sure to read more <a href=\"http://www.citrix.com/English/ps2/products/product.asp?contentID=2311977\" target=\"_blank\">here</a>.','CITRIX CLOUDGATEWAY 2. LET\'S GO MOBILE','','publish','open','open','','citrix-cloudgateway-2-lets-go-mobile','','','2012-06-20 20:22:32','2012-06-20 20:22:32','',0,'http://egroup.jasonmangone.com/?p=6826',0,'post','',0),(6827,44,'2012-06-16 16:53:15','2012-06-16 16:53:15','So Citrix Synergy has wrapped up in San Francisco and all the news is still buzzing around. Citrix showcased many new initiatives and products and intend to touch on a very specific one here... We\'ll maybe a couple because of the integration it brings. Question for you guys. How many laptops, phones, iPad\'s, etc., do you think were running around at this conference? My guess hundreds of thousands easily, expand that to all of San Francisco and it\'s easily millions. Mobile data and even more so the mobile workforce is everywhere! The days of sitting in your cube all day has passed. People want their data and applications everywhere they go. Which raises a question... How the heck do we get all these different devices to have all of our data and applications all the time and actually function? That\'s a good question, read more to find out!<!--more-->\n\nCitrix has had a solution for some time now called CloudGateway. Straight from Citrix\'s website its description is as follows...\n\n<em>Citrix CloudGateway is an enterprise mobility management solution that aggregates, controls and delivers Windows, web, SaaS and mobile apps, and data, to any device, anywhere. CloudGateway provides end-users with a unified single point of access and self-service to all of their business apps on any device anywhere. It also provides IT with a comprehensive single point of aggregation and control for all apps, data, devices and identities.</em>\n\nThat\'s a great description and I couldn\'t have said it better myself, to put it simply... Citrix gets you your stuff where you want it! Well almost, with all the devices out there, web browsers, and everything else to deal with it has been truly difficult to get every single device on board. Citrix has been actively working to change all of that and announced at Synergy this year CloudGateway 2. CloudGateway is packed full of goodness, but the big point for me? True mobility! Citrix CloudGateway 2 is an amazingly powerful update to its enterprise mobility solution that adds extensive mobile application management capabilities, including full support for native HTML 5, iOS and Android apps. This update hooks almost all devices out there, in short they have created a monster! By utilizing the CloudGateway StoreFront you can now get to your applications from any device but what about your data? No problem! CloudGateway 2 now integrates with Citrix Sharefile. If you guys dont know about this product do yourself and favor and check it out <a href=\"http://www.citrix.com/english/ps2/products/product.asp?contentid=2320956\" target=\"_blank\">here</a>. Sharefile is a fantastic product allowing you to securely share your data with anyone, anywhere on any device. Do we see a trend here? Anywhere, anyone, any device. It\'s the future folks and it is here, CloudGateway 2 is here and will pave the way for your \"Corporate Mobile Revolution\". This is your easy button to the cloud, by using CloudGateway, you are able to handle all your devices through the Storefront, access and share data through Sharefile and run your application with XenApp and all of this coupled together with the Citrix Receiver. If you aren\'t utilizing the Citrix Receiver and you are a Citrix environment then shame on you! You are missing out, make sure you download it from your app store or market or whatever you use on whatever device you have! CloudGateway 2 should hit the streets in July so keep an eye out and make sure to read more <a href=\"http://www.citrix.com/English/ps2/products/product.asp?contentID=2311977\" target=\"_blank\">here</a>.','CITRIX CLOUDGATEWAY 2. LET\'S GO MOBILE','','inherit','open','open','','6826-revision','','','2012-06-16 16:53:15','2012-06-16 16:53:15','',6826,'http://egroup.jasonmangone.com/6826-revision',0,'revision','',0),(6828,44,'2012-06-28 13:03:36','2012-06-28 13:03:36','So for the guys out there who have read a few of my blogs, they know that before I came to eGroup I spent 11 years on the customer facing side of IT, administering storage, VMware, Citrix, etc.. One of my roles during that time period was also managing antivirus on desktops and servers, a fairly critical task because no one wants to have a major virus outbreak. It was never a fun task though, DATs were a pain, so was versioning, and hoping that it was working and that it was actually updating never made you feel good! Well, as I made the jump to my new career at eGroup I had my eyes opened to a new world of technology that I had not been exposed to previously, one of those was Trend Micro\'s Deep Security. As a VMware administrator I played around with different antivirus solutions trying to find one that didn\'t impact CPU utilization on my hosts and virtual machines severely, if it was an antivirus solution I tried it at least once and yet all of them seemed to impact my VM\'s CPU ranging from about 10% to sometimes closer to 30%. I always thought this was ridiculous and that there had to be a better way, well apparently the guys at Trend thought so as well and came up with a solution. Read more after the bump to see how it works!<!--more-->\r\n\r\nHave you ever put any thought into how to protect your hosts? Most people haven\'t they load antivirus on their virtual machines and go about their day, never thinking that their hosts could be hacked or infected. At the end of the day if that were to happen the trickledown effect would take down everything on that host and most likely other hosts with it. Deep Security stops this problem! By protecting VM\'s at the host level and removing \"traditional\" agents from your virtual servers and desktops you know that from the top down you are good to go. Remember that performance hit we were talking about earlier? Yeah it\'s gone!\r\n\r\nWhat does this mean to you? Well, a couple things... First off your virtual desktops and servers are now performing better, in fact you may be able to remove a CPU from some of your VM\'s. Additionally if you are a large enough shop and you shave off 15% CPU utilization off of every VM you have you may be able to remove a host or two, paving the way for further consolidation! It doesn\'t just end at antivirus either Deep Security has a myriad of protection underneath its hood that you can choose from. See below.\r\n\r\n-Anti- Malware Protection for VMware\r\n\r\n-Intrusion Detection and Prevention\r\n\r\n-Application Control\r\n\r\n-Integrity Monitoring\r\n\r\n-Web Application Protection\r\n\r\n-Log Inspection\r\n\r\nThe reality is many people have additional software or even hardware to take care of some of these items, with Deep Security you can remove that and leverage its maximum functionality and be closer to a truly virtualized \"cloud\" model. If you find any of this intriguing I would highly recommend you take a look <a href=\"http://www.trendmicro.com/cloud-content/us/pdfs/business/white-papers/wp_changing-the-game-for-antivirus-vmware.pdf\" target=\"_blank\">here</a> and read this <a href=\"http://www.trendmicro.com/cloud-content/us/pdfs/business/white-papers/wp_changing-the-game-for-antivirus-vmware.pdf\" target=\"_blank\">whitepaper</a>. It details all the inner workings and how it can help your VMware environment!\r\n\r\nBefore I close out if you take a look below you can check out the following diagram and it shows a great depiction of how Deep Security is laid out!\r\n\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/deepsecurity.jpg\"><img class=\"aligncenter size-full wp-image-6829\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/deepsecurity.jpg\" alt=\"\" width=\"576\" height=\"327\" /></a>\r\n\r\n&nbsp;','SHOULDN\'T YOU BE RUNNING TREND MICRO\'S DEEP SECURITY?','','publish','open','open','','shouldnt-you-be-running-trend-micros-deep-security','','','2012-06-28 13:03:36','2012-06-28 13:03:36','',0,'http://egroup.jasonmangone.com/?p=6828',0,'post','',0),(6829,44,'2012-06-16 20:11:24','2012-06-16 20:11:24','','deepsecurity','','inherit','open','open','','deepsecurity','','','2012-06-16 20:11:24','2012-06-16 20:11:24','',6828,'http://egroup.jasonmangone.com/wp-content/uploads/2012/06/deepsecurity.jpg',0,'attachment','image/jpeg',0),(6830,44,'2012-06-16 20:10:20','2012-06-16 20:10:20','So for the guys out there who have read a few of my blogs, they know that before I came to eGroup I spent 11 years on the customer facing side of IT, administering storage, VMware, Citrix, etc.. One of my roles during that time period was also managing antivirus on desktops and servers, a fairly critical task because no one wants to have a major virus outbreak. It was never a fun task though, DATs were a pain, so was versioning, and hoping that it was working and that it was actually updating never made you feel good! Well, as I made the jump to my new career at eGroup I had my eyes opened to a new world of technology that I had not been exposed to previously, one of those was Trend Micro\'s Deep Security. As a VMware administrator I played around with different antivirus solutions trying to find one that didn\'t impact CPU utilization on my hosts and virtual machines severely, if it was an antivirus solution I tried it at least once and yet all of them seemed to impact my VM\'s CPU ranging from about 10% to sometimes closer to 30%. I always thought this was ridiculous and that there had to be a better way, well apparently the guys at Trend thought so as well and came up with a solution. Read more after the bump to see how it works!<!--more-->\n\nHave you ever put any thought into how to protect your hosts? Most people haven\'t they load antivirus on their virtual machines and go about their day, never thinking that their hosts could be hacked or infected. At the end of the day if that were to happen the trickledown effect would take down everything on that host and most likely other hosts with it. Deep Security stops this problem! By protecting VM\'s at the host level and removing \"traditional\" agents from your virtual servers and desktops you know that from the top down you are good to go. Remember that performance hit we were talking about earlier? Yeah it\'s gone!\n\nWhat does this mean to you? Well, a couple things... First off your virtual desktops and servers are now performing better, in fact you may be able to remove a CPU from some of your VM\'s. Additionally if you are a large enough shop and you shave off 15% CPU utilization off of every VM you have you may be able to remove a host or two, paving the way for further consolidation! It doesn\'t just end at antivirus either Deep Security has a myriad of protection underneath its hood that you can choose from. See below.\n\n-Anti- Malware Protection for VMware\n\n-Intrusion Detection and Prevention\n\n-Application Control\n\n-Integrity Monitoring\n\n-Web Application Protection\n\n-Log Inspection\n\nThe reality is many people have additional software or even hardware to take care of some of these items, with Deep Security you can remove that and leverage its maximum functionality and be closer to a truly virtualize \"cloud\" model. If you find any of this intriuging I would highly recommend you take a look <a href=\"http://www.trendmicro.com/cloud-content/us/pdfs/business/white-papers/wp_changing-the-game-for-antivirus-vmware.pdf\" target=\"_blank\">here</a> and read this <a href=\"http://www.trendmicro.com/cloud-content/us/pdfs/business/white-papers/wp_changing-the-game-for-antivirus-vmware.pdf\" target=\"_blank\">whitepaper</a>. It details all the inner workings and how it can help your VMware environment!\n\nBefore I close out if you take a look below you can check out the following diagram and it shows a great depiction of how Deep Security is laid out!\n\n&nbsp;\n\n&nbsp;\n\n&nbsp;','SHOULDN\'T YOU BE RUNNING TREND MICRO\'S DEEP SECURITY?','','inherit','open','open','','6828-revision','','','2012-06-16 20:10:20','2012-06-16 20:10:20','',6828,'http://egroup.jasonmangone.com/6828-revision',0,'revision','',0),(6831,44,'2012-06-16 20:11:40','2012-06-16 20:11:40','So for the guys out there who have read a few of my blogs, they know that before I came to eGroup I spent 11 years on the customer facing side of IT, administering storage, VMware, Citrix, etc.. One of my roles during that time period was also managing antivirus on desktops and servers, a fairly critical task because no one wants to have a major virus outbreak. It was never a fun task though, DATs were a pain, so was versioning, and hoping that it was working and that it was actually updating never made you feel good! Well, as I made the jump to my new career at eGroup I had my eyes opened to a new world of technology that I had not been exposed to previously, one of those was Trend Micro\'s Deep Security. As a VMware administrator I played around with different antivirus solutions trying to find one that didn\'t impact CPU utilization on my hosts and virtual machines severely, if it was an antivirus solution I tried it at least once and yet all of them seemed to impact my VM\'s CPU ranging from about 10% to sometimes closer to 30%. I always thought this was ridiculous and that there had to be a better way, well apparently the guys at Trend thought so as well and came up with a solution. Read more after the bump to see how it works!<!--more-->\r\n\r\nHave you ever put any thought into how to protect your hosts? Most people haven\'t they load antivirus on their virtual machines and go about their day, never thinking that their hosts could be hacked or infected. At the end of the day if that were to happen the trickledown effect would take down everything on that host and most likely other hosts with it. Deep Security stops this problem! By protecting VM\'s at the host level and removing \"traditional\" agents from your virtual servers and desktops you know that from the top down you are good to go. Remember that performance hit we were talking about earlier? Yeah it\'s gone!\r\n\r\nWhat does this mean to you? Well, a couple things... First off your virtual desktops and servers are now performing better, in fact you may be able to remove a CPU from some of your VM\'s. Additionally if you are a large enough shop and you shave off 15% CPU utilization off of every VM you have you may be able to remove a host or two, paving the way for further consolidation! It doesn\'t just end at antivirus either Deep Security has a myriad of protection underneath its hood that you can choose from. See below.\r\n\r\n-Anti- Malware Protection for VMware\r\n\r\n-Intrusion Detection and Prevention\r\n\r\n-Application Control\r\n\r\n-Integrity Monitoring\r\n\r\n-Web Application Protection\r\n\r\n-Log Inspection\r\n\r\nThe reality is many people have additional software or even hardware to take care of some of these items, with Deep Security you can remove that and leverage its maximum functionality and be closer to a truly virtualized \"cloud\" model. If you find any of this intriguing I would highly recommend you take a look <a href=\"http://www.trendmicro.com/cloud-content/us/pdfs/business/white-papers/wp_changing-the-game-for-antivirus-vmware.pdf\" target=\"_blank\">here</a> and read this <a href=\"http://www.trendmicro.com/cloud-content/us/pdfs/business/white-papers/wp_changing-the-game-for-antivirus-vmware.pdf\" target=\"_blank\">whitepaper</a>. It details all the inner workings and how it can help your VMware environment!\r\n\r\nBefore I close out if you take a look below you can check out the following diagram and it shows a great depiction of how Deep Security is laid out!\r\n\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/deepsecurity.jpg\"><img class=\"aligncenter size-full wp-image-6829\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/deepsecurity.jpg\" alt=\"\" width=\"576\" height=\"327\" /></a>\r\n\r\n&nbsp;','SHOULDN\'T YOU BE RUNNING TREND MICRO\'S DEEP SECURITY?','','inherit','open','open','','6828-revision-2','','','2012-06-16 20:11:40','2012-06-16 20:11:40','',6828,'http://egroup.jasonmangone.com/6828-revision-2',0,'revision','',0),(6832,35,'2012-06-18 03:12:44','2012-06-18 03:12:44','Recently I built a basic Windows Server 2008 R2 template for a customer. We downloaded the ISO, installed to a fresh VM, ran all available Windows Updates, and installed VMware tools. We ran sysprep with the \"Generalize\" option in order to have the VM generate a new <a href=\"http://en.wikipedia.org/wiki/Security_Identifier\">SID</a> the next time it booted and shut down the VM so that it could be converted to a template. We began to deploy VMs from this template, but quickly realized that VMware tools wasn\'t fully functional. The mouse was laggy on the VM console and was captured in the console window (similar to not having VMware Tools installed at all).<!--more-->\r\n\r\nI double checked the vSphere client to verify that the host detected that VMware tools was installed and receiving guest heartbeats - all appeared to be well. The VM Device Manager listed a \"PS/2 Compatible Mouse\" installed as the mouse rather than a \"VMware Pointing Device\". The fix was to force a driver update and use the VMware mouse driver located at C:\\Program Files\\Common Files\\VMware\\Drivers\\mouse. The <a href=\"http://communities.vmware.com/message/1896024\">VMware Communities</a> led me to a permanent fix for this problem as well: before running sysprep and converting your VM to a template, load the Registry Editor and browse to HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\Sysprep\\Settings\\sppnp where you can set PersistAllDeviceInstalls to 1. This registry key tells the guest OS not to remove any drivers for devices that are currently present. Since the virtual hardware for every VM deployed from the template will be identical, it will be safe to leave all drivers in place.\r\n\r\nFor complex sysprep deployments utilizing an XML answer file, the following code can be used to achieve the same effect:\r\n<pre>&lt;settings pass=\"generalize\"&gt;\r\n &lt;component name=\"Microsoft-Windows-PnpSysprep\" processorArchitecture=\"amd64\" publicKeyToken=\"31bf3856ad364e35\" language=\"neutral\" versionScope=\"nonSxS\" xmlns:wcm=\"http://schemas.microsoft.com/WMIConfig/2002/State\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"&gt;\r\n &lt;PersistAllDeviceInstalls&gt;true&lt;/PersistAllDeviceInstalls&gt;\r\n &lt;/component&gt;\r\n &lt;/settings&gt;</pre>\r\nSpecial thanks to crkusch, arbsysts, and the VMware Communities for sharing their knowledge that makes this fix possible.','2008R2 VM TEMPLATES AND MOUSE DRIVERS','','publish','open','open','','2008r2-vm-templates-and-mouse-drivers','','','2012-06-18 03:12:44','2012-06-18 03:12:44','',0,'http://egroup.jasonmangone.com/?p=6832',0,'post','',0),(6833,35,'2012-06-18 03:09:34','2012-06-18 03:09:34','Recently I built a basic Windows Server 2008 R2 template for a customer. We downloaded the ISO, installed to a fresh VM, ran all available Windows Updates, and installed VMware tools. We ran sysprep with the \"Generalize\" option in order to have the VM generate a new <a href=\"http://en.wikipedia.org/wiki/Security_Identifier\">SID</a> the next time it booted and shut down the VM so that it could be converted to a template. We began to deploy VMs from this template, but quickly realized that VMware tools wasn\'t fully functional. The mouse was laggy on the VM console and was captured in the console window (similar to not having VMware Tools installed at all).<!--more-->\n\nI double checked the vSphere client to verify that the host detected that VMware tools was installed and receiving guest heartbeats - all appeared to be well. The VM Device Manager listed a \"PS/2 Compatible Mouse\" installed as the mouse rather than a \"VMware Pointing Device\". The fix was to force a driver update and use the VMware mouse driver located at C:\\Program Files\\Common Files\\VMware\\Drivers\\mouse. The VMware forums led me to a permanent fix for this problem as well: before running sysprep and converting your VM to a template, load the Registry Editor and browse to HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\Sysprep\\Settings\\sppnp where you can set PersistAllDeviceInstalls to 1. This registry key tells the guest OS not to remove any drivers for devices that are currently present. Since the virtual hardware for every VM deployed from the template will be identical, it will be safe to leave all drivers in place.\n\nFor complex sysprep deployments utilizing an XML answer file, the following XML can be used to achieve the same effect:\n<pre>&lt;settings pass=\"generalize\"&gt;\n &lt;component name=\"Microsoft-Windows-PnpSysprep\" processorArchitecture=\"amd64\" publicKeyToken=\"31bf3856ad364e35\" language=\"neutral\" versionScope=\"nonSxS\" xmlns:wcm=\"http://schemas.microsoft.com/WMIConfig/2002/State\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"&gt;\n &lt;PersistAllDeviceInstalls&gt;true&lt;/PersistAllDeviceInstalls&gt;\n &lt;/component&gt;\n &lt;/settings&gt;</pre>\nSpecial thanks to crkusch, arbsysts, and the VMware forums for shari','2008R2 VM TEMPLATES AND MOUSE DRIVERS','','inherit','open','open','','6832-revision','','','2012-06-18 03:09:34','2012-06-18 03:09:34','',6832,'http://egroup.jasonmangone.com/6832-revision',0,'revision','',0),(6834,35,'2012-06-18 03:10:35','2012-06-18 03:10:35','Recently I built a basic Windows Server 2008 R2 template for a customer. We downloaded the ISO, installed to a fresh VM, ran all available Windows Updates, and installed VMware tools. We ran sysprep with the \"Generalize\" option in order to have the VM generate a new <a href=\"http://en.wikipedia.org/wiki/Security_Identifier\">SID</a> the next time it booted and shut down the VM so that it could be converted to a template. We began to deploy VMs from this template, but quickly realized that VMware tools wasn\'t fully functional. The mouse was laggy on the VM console and was captured in the console window (similar to not having VMware Tools installed at all).<!--more-->\n\nI double checked the vSphere client to verify that the host detected that VMware tools was installed and receiving guest heartbeats - all appeared to be well. The VM Device Manager listed a \"PS/2 Compatible Mouse\" installed as the mouse rather than a \"VMware Pointing Device\". The fix was to force a driver update and use the VMware mouse driver located at C:\\Program Files\\Common Files\\VMware\\Drivers\\mouse. The VMware forums led me to a permanent fix for this problem as well: before running sysprep and converting your VM to a template, load the Registry Editor and browse to HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\Sysprep\\Settings\\sppnp where you can set PersistAllDeviceInstalls to 1. This registry key tells the guest OS not to remove any drivers for devices that are currently present. Since the virtual hardware for every VM deployed from the template will be identical, it will be safe to leave all drivers in place.\n\nFor complex sysprep deployments utilizing an XML answer file, the following XML can be used to achieve the same effect:\n<pre>&lt;settings pass=\"generalize\"&gt;\n &lt;component name=\"Microsoft-Windows-PnpSysprep\" processorArchitecture=\"amd64\" publicKeyToken=\"31bf3856ad364e35\" language=\"neutral\" versionScope=\"nonSxS\" xmlns:wcm=\"http://schemas.microsoft.com/WMIConfig/2002/State\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"&gt;\n &lt;PersistAllDeviceInstalls&gt;true&lt;/PersistAllDeviceInstalls&gt;\n &lt;/component&gt;\n &lt;/settings&gt;</pre>\nSpecial thanks to crkusch, arbsysts, and the VMware forums for sharing their knowledge that makes this fix possible.','2008R2 VM TEMPLATES AND MOUSE DRIVERS','','inherit','open','open','','6832-revision-2','','','2012-06-18 03:10:35','2012-06-18 03:10:35','',6832,'http://egroup.jasonmangone.com/6832-revision-2',0,'revision','',0),(6835,35,'2012-06-18 03:11:55','2012-06-18 03:11:55','Recently I built a basic Windows Server 2008 R2 template for a customer. We downloaded the ISO, installed to a fresh VM, ran all available Windows Updates, and installed VMware tools. We ran sysprep with the \"Generalize\" option in order to have the VM generate a new <a href=\"http://en.wikipedia.org/wiki/Security_Identifier\">SID</a> the next time it booted and shut down the VM so that it could be converted to a template. We began to deploy VMs from this template, but quickly realized that VMware tools wasn\'t fully functional. The mouse was laggy on the VM console and was captured in the console window (similar to not having VMware Tools installed at all).<!--more-->\r\n\r\nI double checked the vSphere client to verify that the host detected that VMware tools was installed and receiving guest heartbeats - all appeared to be well. The VM Device Manager listed a \"PS/2 Compatible Mouse\" installed as the mouse rather than a \"VMware Pointing Device\". The fix was to force a driver update and use the VMware mouse driver located at C:\\Program Files\\Common Files\\VMware\\Drivers\\mouse. The <a href=\"http://communities.vmware.com/message/1896024\">VMware Communities</a> led me to a permanent fix for this problem as well: before running sysprep and converting your VM to a template, load the Registry Editor and browse to HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Setup\\Sysprep\\Settings\\sppnp where you can set PersistAllDeviceInstalls to 1. This registry key tells the guest OS not to remove any drivers for devices that are currently present. Since the virtual hardware for every VM deployed from the template will be identical, it will be safe to leave all drivers in place.\r\n\r\nFor complex sysprep deployments utilizing an XML answer file, the following code can be used to achieve the same effect:\r\n<pre>&lt;settings pass=\"generalize\"&gt;\r\n &lt;component name=\"Microsoft-Windows-PnpSysprep\" processorArchitecture=\"amd64\" publicKeyToken=\"31bf3856ad364e35\" language=\"neutral\" versionScope=\"nonSxS\" xmlns:wcm=\"http://schemas.microsoft.com/WMIConfig/2002/State\" xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"&gt;\r\n &lt;PersistAllDeviceInstalls&gt;true&lt;/PersistAllDeviceInstalls&gt;\r\n &lt;/component&gt;\r\n &lt;/settings&gt;</pre>\r\nSpecial thanks to crkusch, arbsysts, and the VMware Communities for sharing their knowledge that makes this fix possible.','2008R2 VM TEMPLATES AND MOUSE DRIVERS','','inherit','open','open','','6832-revision-3','','','2012-06-18 03:11:55','2012-06-18 03:11:55','',6832,'http://egroup.jasonmangone.com/6832-revision-3',0,'revision','',0),(6936,24,'2012-06-27 01:29:38','2012-06-27 01:29:38','I ran into an issue today where What\'s Up Gold was showing interfaces down that were up in the switch.  In What\'s Up Gold each interface is referenced by an index number that is dynamically assigned by the IOS on startup.  The problems begin when a router or a switch are rebooted.  It dynamically assigns the interfaces an index number and it may or may not be the same as the index number before.\r\n\r\nTo fix this issue under global config mode type the command- Switch(config)# <strong>snmp-server ifindex persist</strong> then issue a <strong>copy run start</strong> to save the config.  Now the index table is saved with the running configuration and will keep the same index number during a reload.  ','SNMP-Server ifindex persist','','publish','open','open','','snmp-server-ifindex-persist','','','2012-06-27 01:31:57','2012-06-27 01:31:57','',0,'http://egroup.jasonmangone.com/?p=6936',0,'post','',0),(6837,2,'2012-06-18 15:55:20','2012-06-18 15:55:20','Media Contact:\r\nLiz Wilmes\r\n843.284.0146 x9012\r\n<a href=\"mailto:Elizabeth.Wilmes@eGroup-us.com\">Elizabeth.Wilmes@eGroup-us.com</a>\r\n\r\nFor Immediate Release\r\n\r\n<strong><em>B2B technology veteran to lead eGroup’s strategic marketing initiatives</em></strong>\r\n\r\nMT. PLEASANT, S.C. – June 18, 2012 – <a href=\"http://egroup.jasonmangone.com/\">eGroup</a>, the Southeast’s leading provider of <a href=\"http://egroup.jasonmangone.com/what-we-do/services/cloud-services\">cloud</a>, <a href=\"http://egroup.jasonmangone.com/what-we-do/services/application-services\">application</a> and<a href=\"http://egroup.jasonmangone.com/what-we-do/services/end-user-computing\"> end-user computing</a> services, today announced that Rich Young has joined as Marketing and Corporate Communications Manager.\r\n\r\nIn this newly created role, Young will focus on driving eGroup’s strategic marketing and corporate communications initiatives as well as increasing brand awareness across the Southeast and within new vertical markets.<!--more-->\r\n\r\nYoung brings over 12 years of marketing, communications and public relations experience to eGroup. In his most recent role, Young served as Vice President at LEWIS PR leading thought leadership programs and digital communication campaigns on behalf of clients such as Unisys, Information Builders, Progress Software and Proofpoint.\r\n\r\n“We are pleased to welcome Rich to the eGroup team. His technology sector knowledge coupled with his marketing and communications expertise will help to bring the us to the next level and differentiate the company in a competitive space,” said Mike Stokes, Director of Sales, eGroup. “As part of our growth strategy, eGroup is focused on refining our overall marketing and branding initiatives to better serve our customer base as well as identify new market opportunities. We believe Rich is the ideal person to lead these efforts.”\r\n\r\nPrior to LEWIS PR, Young held positions at two Boston-area high tech agencies an as an industry analyst at Yankee Group, covering the integrator, data center, managed service provider and software-as-a-service industries. His research and commentary appeared in technology trade and business media.\r\n\r\nYoung holds a BA, Communications from Boston College.\r\n\r\n<strong>About eGroup</strong>\r\n\r\nHeadquartered in Mt. Pleasant, S.C., <a href=\"http://egroup.jasonmangone.com/\">eGroup</a> provides innovative <a href=\"http://egroup.jasonmangone.com/what-we-do/services/cloud-services\">cloud</a>, <a href=\"http://egroup.jasonmangone.com/what-we-do/services/application-services\">application</a> and <a href=\"http://egroup.jasonmangone.com/what-we-do/services/end-user-computing\">end-user computing</a> services to businesses across the Southeast. One of the region’s fastest growing companies and winner of the 2012 CRN “Tech Elite 250”, eGroup’s solutions drive customer revenue while reducing cost to maintain IT infrastructures. Visit <a href=\"http://www.eGroup-us.com\">www.eGroup-us.com</a> or call 1.877.eGROUP.1 (1.877.347.6871) for more information.\r\n\r\n&nbsp;','RICH YOUNG JOINS eGROUP AS MARKETING AND CORPORATE COMMUNICATIONS MANAGER','','publish','open','open','','rich-young-joins-egroup-as-marketing-and-corporate-communications-manager','','','2012-06-18 15:59:08','2012-06-18 15:59:08','',0,'http://egroup.jasonmangone.com/?p=6837',0,'post','',0),(6838,2,'2012-06-18 15:54:36','2012-06-18 15:54:36','Media Contact:\nLiz Wilmes\n843.284.0146 x9012\n<a href=\"mailto:Elizabeth.Wilmes@eGroup-us.com\">Elizabeth.Wilmes@eGroup-us.com</a>\n\nFor Immediate Release\n\n<strong><em>B2B technology veteran to lead eGroup’s strategic marketing initiatives</em></strong>\n\nMT. PLEASANT, S.C. – June 18, 2012 – <a href=\"http://egroup.jasonmangone.com/\">eGroup</a>, the Southeast’s leading provider of <a href=\"http://egroup.jasonmangone.com/what-we-do/services/cloud-services\">cloud</a>, <a href=\"http://egroup.jasonmangone.com/what-we-do/services/application-services\">application</a> and<a href=\"http://egroup.jasonmangone.com/what-we-do/services/end-user-computing\"> end-user computing</a> services, today announced that Rich Young has joined as Marketing and Corporate Communications Manager.\n\nIn this newly created role, Young will focus on driving eGroup’s strategic marketing and corporate communications initiatives as well as increasing brand awareness across the Southeast and within new vertical markets.\n\nYoung brings over 12 years of marketing, communications and public relations experience to eGroup. In his most recent role, Young served as Vice President at LEWIS PR leading thought leadership programs and digital communication campaigns on behalf of clients such as Unisys, Information Builders, Progress Software and Proofpoint.\n\n“We are pleased to welcome Rich to the eGroup team. His technology sector knowledge coupled with his marketing and communications expertise will help to bring the us to the next level and differentiate the company in a competitive space,” said Mike Stokes, Director of Sales, eGroup. “As part of our growth strategy, eGroup is focused on refining our overall marketing and branding initiatives to better serve our customer base as well as identify new market opportunities. We believe Rich is the ideal person to lead these efforts.”\n\nPrior to LEWIS PR, Young held positions at two Boston-area high tech agencies an as an industry analyst at Yankee Group, covering the integrator, data center, managed service provider and software-as-a-service industries. His research and commentary appeared in technology trade and business media.\n\nYoung holds a BA, Communications from Boston College.\n\n<strong>About eGroup</strong>\n\nHeadquartered in Mt. Pleasant, S.C., <a href=\"http://egroup.jasonmangone.com/\">eGroup</a> provides innovative <a href=\"http://egroup.jasonmangone.com/what-we-do/services/cloud-services\">cloud</a>, <a href=\"http://egroup.jasonmangone.com/what-we-do/services/application-services\">application</a> and <a href=\"http://egroup.jasonmangone.com/what-we-do/services/end-user-computing\">end-user computing</a> services to businesses across the Southeast. One of the region’s fastest growing companies and winner of the 2012 CRN “Tech Elite 250”, eGroup’s solutions drive customer revenue while reducing cost to maintain IT infrastructures. Visit <a href=\"http://www.eGroup-us.com\">www.eGroup-us.com</a> or call 1.877.eGROUP.1 (1.877.347.6871) for more information.\n\n&nbsp;','RICH YOUNG JOINS eGROUP AS MARKETING AND CORPORATE COMMUNICATIONS MANAGER','','inherit','open','open','','6837-revision','','','2012-06-18 15:54:36','2012-06-18 15:54:36','',6837,'http://egroup.jasonmangone.com/6837-revision',0,'revision','',0),(6839,2,'2012-06-18 16:00:12','2012-06-18 16:00:12','Media Contact:\nLiz Wilmes\n843.284.0146 x9012\n<a href=\"mailto:Elizabeth.Wilmes@eGroup-us.com\">Elizabeth.Wilmes@eGroup-us.com</a>\n\nFor Immediate Release\n\n<strong><em>B2B technology veteran to lead eGroup’s strategic marketing initiatives</em></strong>\n\nMT. PLEASANT, S.C. – June 18, 2012 – <a href=\"http://egroup.jasonmangone.com/\">eGroup</a>, the Southeast’s leading provider of <a href=\"http://egroup.jasonmangone.com/what-we-do/services/cloud-services\">cloud</a>, <a href=\"http://egroup.jasonmangone.com/what-we-do/services/application-services\">application</a> and<a href=\"http://egroup.jasonmangone.com/what-we-do/services/end-user-computing\"> end-user computing</a> services, today announced that Rich Young has joined as Marketing and Corporate Communications Manager.\n\nIn this newly created role, Young will focus on driving eGroup’s strategic marketing and corporate communications initiatives as well as increasing brand awareness across the Southeast and within new vertical markets.<!--more-->\n\nYoung brings over 12 years of marketing, communications and public relations experience to eGroup. In his most recent role, Young served as Vice President at LEWIS PR leading thought leadership programs and digital communication campaigns on behalf of clients such as Unisys, Information Builders, Progress Software and Proofpoint.\n\n“We are pleased to welcome Rich to the eGroup team. His technology sector knowledge coupled with his marketing and communications expertise will help to bring the us to the next level and differentiate the company in a competitive space,” said Mike Stokes, Director of Sales, eGroup. “As part of our growth strategy, eGroup is focused on refining our overall marketing and branding initiatives to better serve our customer base as well as identify new market opportunities. We believe Rich is the ideal person to lead these efforts.”\n\nPrior to LEWIS PR, Young held positions at two Boston-area high tech agencies an as an industry analyst at Yankee Group, covering the integrator, data center, managed service provider and software-as-a-service industries. His research and commentary appeared in technology trade and business media.\n\nYoung holds a BA, Communications from Boston College.\n\n<strong>About eGroup</strong>\n\nHeadquartered in Mt. Pleasant, S.C., <a href=\"http://egroup.jasonmangone.com/\">eGroup</a> provides innovative <a href=\"http://egroup.jasonmangone.com/what-we-do/services/cloud-services\">cloud</a>, <a href=\"http://egroup.jasonmangone.com/what-we-do/services/application-services\">application</a> and <a href=\"http://egroup.jasonmangone.com/what-we-do/services/end-user-computing\">end-user computing</a> services to businesses across the Southeast. One of the region’s fastest growing companies and winner of the 2012 CRN “Tech Elite 250”, eGroup’s solutions drive customer revenue while reducing cost to maintain IT infrastructures. Visit <a href=\"http://www.eGroup-us.com\">www.eGroup-us.com</a> or call 1.877.eGROUP.1 (1.877.347.6871) for more information.\n\n&nbsp;','RICH YOUNG JOINS eGROUP AS MARKETING AND CORPORATE COMMUNICATIONS MANAGER','','inherit','open','open','','6837-autosave','','','2012-06-18 16:00:12','2012-06-18 16:00:12','',6837,'http://egroup.jasonmangone.com/6837-autosave',0,'revision','',0),(6840,2,'2012-06-18 15:55:20','2012-06-18 15:55:20','Media Contact:\r\nLiz Wilmes\r\n843.284.0146 x9012\r\n<a href=\"mailto:Elizabeth.Wilmes@eGroup-us.com\">Elizabeth.Wilmes@eGroup-us.com</a>\r\n\r\nFor Immediate Release\r\n\r\n<strong><em>B2B technology veteran to lead eGroup’s strategic marketing initiatives</em></strong>\r\n\r\nMT. PLEASANT, S.C. – June 18, 2012 – <a href=\"http://egroup.jasonmangone.com/\">eGroup</a>, the Southeast’s leading provider of <a href=\"http://egroup.jasonmangone.com/what-we-do/services/cloud-services\">cloud</a>, <a href=\"http://egroup.jasonmangone.com/what-we-do/services/application-services\">application</a> and<a href=\"http://egroup.jasonmangone.com/what-we-do/services/end-user-computing\"> end-user computing</a> services, today announced that Rich Young has joined as Marketing and Corporate Communications Manager.\r\n\r\nIn this newly created role, Young will focus on driving eGroup’s strategic marketing and corporate communications initiatives as well as increasing brand awareness across the Southeast and within new vertical markets.<!--more-->\r\n\r\nYoung brings over 12 years of marketing, communications and public relations experience to eGroup. In his most recent role, Young served as Vice President at LEWIS PR leading thought leadership programs and digital communication campaigns on behalf of clients such as Unisys, Information Builders, Progress Software and Proofpoint.\r\n\r\n“We are pleased to welcome Rich to the eGroup team. His technology sector knowledge coupled with his marketing and communications expertise will help to bring the us to the next level and differentiate the company in a competitive space,” said Mike Stokes, Director of Sales, eGroup. “As part of our growth strategy, eGroup is focused on refining our overall marketing and branding initiatives to better serve our customer base as well as identify new market opportunities. We believe Rich is the ideal person to lead these efforts.”\r\n\r\nPrior to LEWIS PR, Young held positions at two Boston-area high tech agencies an as an industry analyst at Yankee Group, covering the integrator, data center, managed service provider and software-as-a-service industries. His research and commentary appeared in technology trade and business media.\r\n\r\nYoung holds a BA, Communications from Boston College.\r\n\r\n<strong>About eGroup</strong>\r\n\r\nHeadquartered in Mt. Pleasant, S.C., <a href=\"http://egroup.jasonmangone.com/\">eGroup</a> provides innovative <a href=\"http://egroup.jasonmangone.com/what-we-do/services/cloud-services\">cloud</a>, <a href=\"http://egroup.jasonmangone.com/what-we-do/services/application-services\">application</a> and <a href=\"http://egroup.jasonmangone.com/what-we-do/services/end-user-computing\">end-user computing</a> services to businesses across the Southeast. One of the region’s fastest growing companies and winner of the 2012 CRN “Tech Elite 250”, eGroup’s solutions drive customer revenue while reducing cost to maintain IT infrastructures. Visit <a href=\"http://www.eGroup-us.com\">www.eGroup-us.com</a> or call 1.877.eGROUP.1 (1.877.347.6871) for more information.\r\n\r\n&nbsp;','RICH YOUNG JOINS eGROUP AS MARKETING AND CORPORATE COMMUNICATIONS MANAGER','','inherit','open','open','','6837-revision-2','','','2012-06-18 15:55:20','2012-06-18 15:55:20','',6837,'http://egroup.jasonmangone.com/6837-revision-2',0,'revision','',0),(6841,2,'2012-06-18 15:56:30','2012-06-18 15:56:30','Media Contact:\r\nLiz Wilmes\r\n843.284.0146 x9012\r\n<a href=\"mailto:Elizabeth.Wilmes@eGroup-us.com\">Elizabeth.Wilmes@eGroup-us.com</a>\r\n\r\nFor Immediate Release\r\n\r\n<strong><em>B2B technology veteran to lead eGroup’s strategic marketing initiatives</em></strong>\r\n\r\nMT. PLEASANT, S.C. – June 18, 2012 – <a href=\"http://egroup.jasonmangone.com/\">eGroup</a>, the Southeast’s leading provider of <a href=\"http://egroup.jasonmangone.com/what-we-do/services/cloud-services\">cloud</a>, <a href=\"http://egroup.jasonmangone.com/what-we-do/services/application-services\">application</a> and<a href=\"http://egroup.jasonmangone.com/what-we-do/services/end-user-computing\"> end-user computing</a> services, today announced that Rich Young has joined as Marketing and Corporate Communications Manager.\r\n\r\nIn this newly created role, Young will focus on driving eGroup’s strategic marketing and corporate communications initiatives as well as increasing brand awareness across the Southeast and within new vertical markets.<!--more-->\r\n\r\nYoung brings over 12 years of marketing, communications and public relations experience to eGroup. In his most recent role, Young served as Vice President at LEWIS PR leading thought leadership programs and digital communication campaigns on behalf of clients such as Unisys, Information Builders, Progress Software and Proofpoint.\r\n\r\n“We are pleased to welcome Rich to the eGroup team. His technology sector knowledge coupled with his marketing and communications expertise will help to bring the us to the next level and differentiate the company in a competitive space,” said Mike Stokes, Director of Sales, eGroup. “As part of our growth strategy, eGroup is focused on refining our overall marketing and branding initiatives to better serve our customer base as well as identify new market opportunities. We believe Rich is the ideal person to lead these efforts.”\r\n\r\nPrior to LEWIS PR, Young held positions at two Boston-area high tech agencies an as an industry analyst at Yankee Group, covering the integrator, data center, managed service provider and software-as-a-service industries. His research and commentary appeared in technology trade and business media.\r\n\r\nYoung holds a BA, Communications from Boston College.\r\n\r\n<strong>About eGroup</strong>\r\n\r\nHeadquartered in Mt. Pleasant, S.C., <a href=\"http://egroup.jasonmangone.com/\">eGroup</a> provides innovative <a href=\"http://egroup.jasonmangone.com/what-we-do/services/cloud-services\">cloud</a>, <a href=\"http://egroup.jasonmangone.com/what-we-do/services/application-services\">application</a> and <a href=\"http://egroup.jasonmangone.com/what-we-do/services/end-user-computing\">end-user computing</a> services to businesses across the Southeast. One of the region’s fastest growing companies and winner of the 2012 CRN “Tech Elite 250”, eGroup’s solutions drive customer revenue while reducing cost to maintain IT infrastructures. Visit <a href=\"http://www.eGroup-us.com\">www.eGroup-us.com</a> or call 1.877.eGROUP.1 (1.877.347.6871) for more information.\r\n\r\n&nbsp;','RICH YOUNG JOINS eGROUP AS MARKETING AND CORPORATE COMMUNICATIONS MANAGER','','inherit','open','open','','6837-revision-3','','','2012-06-18 15:56:30','2012-06-18 15:56:30','',6837,'http://egroup.jasonmangone.com/6837-revision-3',0,'revision','',0),(6842,2,'2012-06-18 15:57:32','2012-06-18 15:57:32','Media Contact:\r\nLiz Wilmes\r\n843.284.0146 x9012\r\n<a href=\"mailto:Elizabeth.Wilmes@eGroup-us.com\">Elizabeth.Wilmes@eGroup-us.com</a>\r\n\r\nFor Immediate Release\r\n\r\n<strong><em>B2B technology veteran to lead eGroup’s strategic marketing initiatives</em></strong>\r\n\r\nMT. PLEASANT, S.C. – June 18, 2012 – <a href=\"http://egroup.jasonmangone.com/\">eGroup</a>, the Southeast’s leading provider of <a href=\"http://egroup.jasonmangone.com/what-we-do/services/cloud-services\">cloud</a>, <a href=\"http://egroup.jasonmangone.com/what-we-do/services/application-services\">application</a> and<a href=\"http://egroup.jasonmangone.com/what-we-do/services/end-user-computing\"> end-user computing</a> services, today announced that Rich Young has joined as Marketing and Corporate Communications Manager.\r\n\r\nIn this newly created role, Young will focus on driving eGroup’s strategic marketing and corporate communications initiatives as well as increasing brand awareness across the Southeast and within new vertical markets.<!--more-->\r\n\r\nYoung brings over 12 years of marketing, communications and public relations experience to eGroup. In his most recent role, Young served as Vice President at LEWIS PR leading thought leadership programs and digital communication campaigns on behalf of clients such as Unisys, Information Builders, Progress Software and Proofpoint.\r\n\r\n“We are pleased to welcome Rich to the eGroup team. His technology sector knowledge coupled with his marketing and communications expertise will help to bring the us to the next level and differentiate the company in a competitive space,” said Mike Stokes, Director of Sales, eGroup. “As part of our growth strategy, eGroup is focused on refining our overall marketing and branding initiatives to better serve our customer base as well as identify new market opportunities. We believe Rich is the ideal person to lead these efforts.”\r\n\r\nPrior to LEWIS PR, Young held positions at two Boston-area high tech agencies an as an industry analyst at Yankee Group, covering the integrator, data center, managed service provider and software-as-a-service industries. His research and commentary appeared in technology trade and business media.\r\n\r\nYoung holds a BA, Communications from Boston College.\r\n\r\n<strong>About eGroup</strong>\r\n\r\nHeadquartered in Mt. Pleasant, S.C., <a href=\"http://egroup.jasonmangone.com/\">eGroup</a> provides innovative <a href=\"http://egroup.jasonmangone.com/what-we-do/services/cloud-services\">cloud</a>, <a href=\"http://egroup.jasonmangone.com/what-we-do/services/application-services\">application</a> and <a href=\"http://egroup.jasonmangone.com/what-we-do/services/end-user-computing\">end-user computing</a> services to businesses across the Southeast. One of the region’s fastest growing companies and winner of the 2012 CRN “Tech Elite 250”, eGroup’s solutions drive customer revenue while reducing cost to maintain IT infrastructures. Visit <a href=\"http://www.eGroup-us.com\">www.eGroup-us.com</a> or call 1.877.eGROUP.1 (1.877.347.6871) for more information.\r\n\r\n&nbsp;','RICH YOUNG JOINS eGROUP AS MARKETING AND CORPORATE COMMUNICATIONS MANAGER','','inherit','open','open','','6837-revision-4','','','2012-06-18 15:57:32','2012-06-18 15:57:32','',6837,'http://egroup.jasonmangone.com/6837-revision-4',0,'revision','',0),(6843,2,'2012-06-18 15:57:57','2012-06-18 15:57:57','Media Contact:\r\nLiz Wilmes\r\n843.284.0146 x9012\r\n<a href=\"mailto:Elizabeth.Wilmes@eGroup-us.com\">Elizabeth.Wilmes@eGroup-us.com</a>\r\n\r\nFor Immediate Release\r\n\r\n<strong><em>B2B technology veteran to lead eGroup’s strategic marketing initiatives</em></strong>\r\n\r\nMT. PLEASANT, S.C. – June 18, 2012 – <a href=\"http://egroup.jasonmangone.com/\">eGroup</a>, the Southeast’s leading provider of <a href=\"http://egroup.jasonmangone.com/what-we-do/services/cloud-services\">cloud</a>, <a href=\"http://egroup.jasonmangone.com/what-we-do/services/application-services\">application</a> and<a href=\"http://egroup.jasonmangone.com/what-we-do/services/end-user-computing\"> end-user computing</a> services, today announced that Rich Young has joined as Marketing and Corporate Communications Manager.\r\n\r\nIn this newly created role, Young will focus on driving eGroup’s strategic marketing and corporate communications initiatives as well as increasing brand awareness across the Southeast and within new vertical markets.<!--more-->\r\n\r\nYoung brings over 12 years of marketing, communications and public relations experience to eGroup. In his most recent role, Young served as Vice President at LEWIS PR leading thought leadership programs and digital communication campaigns on behalf of clients such as Unisys, Information Builders, Progress Software and Proofpoint.\r\n\r\n“We are pleased to welcome Rich to the eGroup team. His technology sector knowledge coupled with his marketing and communications expertise will help to bring the us to the next level and differentiate the company in a competitive space,” said Mike Stokes, Director of Sales, eGroup. “As part of our growth strategy, eGroup is focused on refining our overall marketing and branding initiatives to better serve our customer base as well as identify new market opportunities. We believe Rich is the ideal person to lead these efforts.”\r\n\r\nPrior to LEWIS PR, Young held positions at two Boston-area high tech agencies an as an industry analyst at Yankee Group, covering the integrator, data center, managed service provider and software-as-a-service industries. His research and commentary appeared in technology trade and business media.\r\n\r\nYoung holds a BA, Communications from Boston College.\r\n\r\n<strong>About eGroup</strong>\r\n\r\nHeadquartered in Mt. Pleasant, S.C., <a href=\"http://egroup.jasonmangone.com/\">eGroup</a> provides innovative <a href=\"http://egroup.jasonmangone.com/what-we-do/services/cloud-services\">cloud</a>, <a href=\"http://egroup.jasonmangone.com/what-we-do/services/application-services\">application</a> and <a href=\"http://egroup.jasonmangone.com/what-we-do/services/end-user-computing\">end-user computing</a> services to businesses across the Southeast. One of the region’s fastest growing companies and winner of the 2012 CRN “Tech Elite 250”, eGroup’s solutions drive customer revenue while reducing cost to maintain IT infrastructures. Visit <a href=\"http://www.eGroup-us.com\">www.eGroup-us.com</a> or call 1.877.eGROUP.1 (1.877.347.6871) for more information.\r\n\r\n&nbsp;','RICH YOUNG JOINS eGROUP AS MARKETING AND CORPORATE COMMUNICATIONS MANAGER','','inherit','open','open','','6837-revision-5','','','2012-06-18 15:57:57','2012-06-18 15:57:57','',6837,'http://egroup.jasonmangone.com/6837-revision-5',0,'revision','',0),(6844,44,'2012-06-16 15:14:00','2012-06-16 15:14:00','Some time now has passed since EMC World tore through Las Vegas and my head is still spinning from all the announcements! One that definitely should be overlooked especially for SMB customers is the newest addition to the VNXe family, the VNXe 3150. For those of you who are not familiar the VNXe line of storage from EMC let me get you up to speed. VNXe systems were designed with one philosophy in mind: keep it simple. It’s storage from the application’s point of view with one clear way to handle any task from initial installation to creating storage for virtual servers. You can shift from managing file shares to creating application storage without missing a beat. What this means to you? Well...You can save time and steps. Provisioning storage is a breeze most any operation you need to do can be lone in 5 clicks or less and most certainly under 10 minutes. Not too shabby huh? All of this is done through the all new Unisphere management interface tailored especially for the VNXe for administrators of all types. This system is easy for the first time storage user to the storage expert. The wizards in this thing are fantastic! Not a wizard fan and don\'t like being bound with their constraints? No problem all the advanced features are still there for the storage pros! Don\'t forget the best part though, the VNXe line provides deduplication, thin provisioning and compression all for FREE, no extra licensing required for any of those features! So, all of that said let me tell you what the VNXe 3150 brings to the table, more after the bump!<!--more-->\r\n\r\nThe new VNXe 3150 is a powerhouse in a tiny package for those who want the high performance and reliability that EMC is known for without the price tag of enterprise class storage. The new VNXe 3150 storage system, adds 50% more performance and capacity per rack unit with the simplicity for which the award-winning VNXe line is already known. This system like its older brothers is purpose-built for IT generalists and is optimized for cloud computing and virtualized applications, and this thing can pack a punch. In the newest 2U model the VNXe 3150 can now hold up to 25 2.5 inch drives in its enclosure, that\'s some serious terabytes per U! Did I mention it also now supports 3TB NL SAS drives as well? With all this space you wanna make sure the performance is there right? No problem, the new VNXe 3150 comes complete with Quad-Core Intel processors giving it the umph it needs and a 10 GB I/O module can be easily added to get the throughput you need from you storage in your environment!  Now I know you are wondering about the older brothers, are they getting left behind? Nope! They are getting upgrades as well especially in the drive area, all VNXe models will now be able to support 2.5 inch drives. I think we can all expect more announcements the second half of this year when the 3150 will be released. EMC has changed the face of the storage industry in many ways and has always provided good, healthy competition and I dont think we will see a slow down in that any time soon!','EMC WELCOMES A NEW MEMBER TO THE VNXe FAMILY','','inherit','open','open','','6823-revision-3','','','2012-06-16 15:14:00','2012-06-16 15:14:00','',6823,'http://egroup.jasonmangone.com/6823-revision-3',0,'revision','',0),(6845,44,'2012-06-18 16:18:56','2012-06-18 16:18:56','Some time now has passed since EMC World tore through Las Vegas and my head is still spinning from all the announcements! One that definitely should be overlooked especially for SMB customers is the newest addition to the VNXe family, the VNXe 3150. For those of you who are not familiar the VNXe line of storage from EMC let me get you up to speed. VNXe systems were designed with one philosophy in mind: keep it simple. It’s storage from the application’s point of view with one clear way to handle any task from initial installation to creating storage for virtual servers. You can shift from managing file shares to creating application storage without missing a beat. What this means to you? Well...You can save time and steps. Provisioning storage is a breeze most any operation you need to do can be lone in 5 clicks or less and most certainly under 10 minutes. Not too shabby huh? All of this is done through the all new Unisphere management interface tailored especially for the VNXe for administrators of all types. This system is easy for the first time storage user to the storage expert. The wizards in this thing are fantastic! Not a wizard fan and don\'t like being bound with their constraints? No problem all the advanced features are still there for the storage pros! Don\'t forget the best part though, the VNXe line provides deduplication, thin provisioning and compression all for FREE, no extra licensing required for any of those features! So, all of that said let me tell you what the VNXe 3150 brings to the table, more after the bump!<!--more-->\r\n\r\nThe new VNXe 3150 is a powerhouse in a tiny package for those who want the high performance and reliability that EMC is known for without the price tag of enterprise class storage. The new VNXe 3150 storage system, adds 50% more performance and capacity per rack unit with the simplicity for which the award-winning VNXe line is already known. This system like its older brothers is purpose-built for IT generalists and is optimized for cloud computing and virtualized applications, and this thing can pack a punch. In the newest 2U model the VNXe 3150 can now hold up to 25 2.5 inch drives in its enclosure, that\'s some serious terabytes per U! Did I mention it also now supports 3TB NL SAS drives as well? With all this space you wanna make sure the performance is there right? No problem, the new VNXe 3150 comes complete with Quad-Core Intel processors giving it the umph it needs and a 10 GB I/O module can be easily added to get the throughput you need from you storage in your environment!  Now I know you are wondering about the older brothers, are they getting left behind? Nope! They are getting upgrades as well especially in the drive area, all VNXe models will now be able to support 2.5 inch drives. I think we can all expect more announcements the second half of this year when the 3150 will be released. EMC has changed the face of the storage industry in many ways and has always provided good, healthy competition and I dont think we will see a slow down in that any time soon!','EMC WELCOMES A NEW MEMBER TO THE VNXe FAMILY','','inherit','open','open','','6823-revision-4','','','2012-06-18 16:18:56','2012-06-18 16:18:56','',6823,'http://egroup.jasonmangone.com/6823-revision-4',0,'revision','',0),(6846,44,'2012-06-18 19:40:25','2012-06-18 19:40:25','Some time now has passed since EMC World tore through Las Vegas and my head is still spinning from all the announcements! One that definitely should not be overlooked especially for SMB customers is the newest addition to the VNXe family, the VNXe 3150. For those of you who are not familiar the VNXe line of storage from EMC let me get you up to speed. VNXe systems were designed with one philosophy in mind: keep it simple. It’s storage from the application’s point of view with one clear way to handle any task from initial installation to creating storage for virtual servers. You can shift from managing file shares to creating application storage without missing a beat. What this means to you? Well...You can save time and steps. Provisioning storage is a breeze most any operation you need to do can be lone in 5 clicks or less and most certainly under 10 minutes. Not too shabby huh? All of this is done through the all new Unisphere management interface tailored especially for the VNXe for administrators of all types. This system is easy for the first time storage user to the storage expert. The wizards in this thing are fantastic! Not a wizard fan and don\'t like being bound with their constraints? No problem all the advanced features are still there for the storage pros! Don\'t forget the best part though, the VNXe line provides deduplication, thin provisioning and compression all for FREE, no extra licensing required for any of those features! So, all of that said let me tell you what the VNXe 3150 brings to the table, more after the bump!<!--more-->\r\n\r\nThe new VNXe 3150 is a powerhouse in a tiny package for those who want the high performance and reliability that EMC is known for without the price tag of enterprise class storage. The new VNXe 3150 storage system, adds 50% more performance and capacity per rack unit with the simplicity for which the award-winning VNXe line is already known. This system like its older brothers is purpose-built for IT generalists and is optimized for cloud computing and virtualized applications, and this thing can pack a punch. In the newest 2U model the VNXe 3150 can now hold up to 25 2.5 inch drives in its enclosure, that\'s some serious terabytes per U! Did I mention it also now supports 3TB NL SAS drives as well? With all this space you wanna make sure the performance is there right? No problem, the new VNXe 3150 comes complete with Quad-Core Intel processors giving it the umph it needs and a 10 GB I/O module can be easily added to get the throughput you need from you storage in your environment!  Now I know you are wondering about the older brothers, are they getting left behind? Nope! They are getting upgrades as well especially in the drive area, all VNXe models will now be able to support 2.5 inch drives. I think we can all expect more announcements the second half of this year when the 3150 will be released. EMC has changed the face of the storage industry in many ways and has always provided good, healthy competition and I dont think we will see a slow down in that any time soon!','EMC WELCOMES A NEW MEMBER TO THE VNXe FAMILY','','inherit','open','open','','6823-revision-5','','','2012-06-18 19:40:25','2012-06-18 19:40:25','',6823,'http://egroup.jasonmangone.com/6823-revision-5',0,'revision','',0),(6847,44,'2012-06-18 19:43:23','2012-06-18 19:43:23','Some time now has passed since EMC World tore through Las Vegas and my head is still spinning from all the announcements! One that definitely should not be overlooked especially for SMB customers is the newest addition to the VNXe family, the VNXe 3150. For those of you who are not familiar the VNXe line of storage from EMC let me get you up to speed. VNXe systems were designed with one philosophy in mind: keep it simple. It’s storage from the application’s point of view with one clear way to handle any task from initial installation to creating storage for virtual servers. You can shift from managing file shares to creating application storage without missing a beat. What this means to you? Well...You can save time and steps. Provisioning storage is a breeze most any operation you need to do can be lone in 5 clicks or less and most certainly under 10 minutes. Not too shabby huh? All of this is done through the all new Unisphere management interface tailored especially for the VNXe for administrators of all types. This system is easy for the first time storage user to the storage expert. The wizards in this thing are fantastic! Not a wizard fan and don\'t like being bound with their constraints? No problem all the advanced features are still there for the storage pros! Don\'t forget the best part though, the VNXe line provides deduplication, thin provisioning and compression all for FREE, no extra licensing required for any of those features! So, all of that said let me tell you what the VNXe 3150 brings to the table, more after the bump!<!--more-->\n\nThe new VNXe 3150 is a powerhouse in a tiny package for those who want the high performance and reliability that EMC is known for without the price tag of enterprise class storage. The new VNXe 3150 storage system, adds 50% more performance and capacity per rack unit with the simplicity for which the award-winning VNXe line is already known. This system like its older brothers is purpose-built for IT generalists and is optimized for cloud computing and virtualized applications, and this thing can pack a punch. In the newest 2U model the VNXe 3150 can now hold up to 25 2.5 inch drives in its enclosure, that\'s some serious terabytes per U! Did I mention it also now supports 3TB NL SAS drives as well? With all this space you wanna make sure the performance is there right? No problem, the new VNXe 3150 comes complete with Quad-Core Intel processors giving it the umph it needs and a 10 GB I/O module can be easily added to get the throughput you need from you storage in your environment!  Now I know you are wondering about the older brothers, are they getting left behind? Nope! They are getting upgrades as well especially in the drive area, all VNXe models will now be able to support 2.5 inch drives. I think we can all expect more announcements the second half of this year when the 3150 will be released. EMC has changed the face of the storage industry in many ways and has always provided good, healthy competition and I dont think we will see a slow down in that any time soon!','EMC WELCOMES A NEW MEMBER TO THE VNXe FAMILY','','inherit','open','open','','6823-autosave','','','2012-06-18 19:43:23','2012-06-18 19:43:23','',6823,'http://egroup.jasonmangone.com/6823-autosave',0,'revision','',0),(7037,23,'2012-07-17 12:14:58','2012-07-17 12:14:58','','Auto Draft','','inherit','open','open','','7036-revision','','','2012-07-17 12:14:58','2012-07-17 12:14:58','',7036,'http://egroup.jasonmangone.com/7036-revision',0,'revision','',0),(6849,29,'2012-06-20 16:08:34','2012-06-20 16:08:34','For my job I rely heavily on Microsoft Visio for design work.  So as you can image when it crashes multiple times in the same day I get a wee bit frustrated.\r\n\r\nSymptom:\r\n\r\nMicrosoft Office (Visio in this case) crashes every time I go to save my work.\r\n\r\nThe Windows Application Event Viewer log reports the following error.\r\n\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/visioERROR.jpg\"><img class=\"aligncenter size-full wp-image-6850\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/visioERROR.jpg\" alt=\"\" width=\"674\" height=\"183\" /></a>\r\n\r\nAfter doing some research, the first thing I did was re-launch the application in safe mode by doing the following: Start --&gt; Run --&gt; visio.exe /safe\r\n\r\nThis can be done for other office applications as well that are experiencing the same symptom, Ex: winword.exe / safe, excel.exe /safe  etc\r\n\r\nBy running the application in safe mode all add-ins are disabled.  Once I did this Visio ran fine for several hours.  From there I disabled my add-ins one by one by going to File --&gt;Options --&gt; Add-ins.\r\n\r\nTurns out it was a my “send to Bluetooth” add-in,  which is now permanently disabled.','Microsoft Office Crash: Exception Code 0xc0000374, Faulting module name: ntdll.dll','','publish','open','open','','microsoft-office-crash-exception-code-0xc0000374-faulting-module-name-ntdll-dll','','','2012-06-21 13:58:51','2012-06-21 13:58:51','',0,'http://egroup.jasonmangone.com/?p=6849',0,'post','',0),(6851,29,'2012-06-20 16:07:35','2012-06-20 16:07:35','For my job I rely heavily on Microsoft Visio for design work.  So as you can image when it crashes multiple times in the same day I get a wee bit frustrated.\n\nSymptom:\n\nMicrosoft Office (Visio in this case) crashes every time I go save my work.\n\nThe Windows Application Event Viewer log reports the following error.\n\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/visioERROR.jpg\"><img class=\"aligncenter size-full wp-image-6850\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/visioERROR.jpg\" alt=\"\" width=\"674\" height=\"183\" /></a>\n\nAfter doing some research, the first thing I did was re-launch the application in safe mode by doing the following: Start --&gt; Run --&gt; visio.exe /safe\n\nThis can be done for other office applications as well that are experiencing the same symptom, Ex: winword.exe / safe, excel.exe /safe  etc\n\nBy running the application in safe mode all add-ins are disabled.  Once I did this Visio ran fine for several hours.  From there I disabled my add-ins one by one by going for File à options àAddins.\n\nTurns out it was a my “send to Bluetooth” add-in,  which is not permanently disabled.','Microsoft Office Crash: Exception Code 0xc0000374, Faulting module name: ntdll.dll','','inherit','open','open','','6849-revision','','','2012-06-20 16:07:35','2012-06-20 16:07:35','',6849,'http://egroup.jasonmangone.com/6849-revision',0,'revision','',0),(6852,29,'2012-06-20 16:08:34','2012-06-20 16:08:34','For my job I rely heavily on Microsoft Visio for design work.  So as you can image when it crashes multiple times in the same day I get a wee bit frustrated.\r\n\r\nSymptom:\r\n\r\nMicrosoft Office (Visio in this case) crashes every time I go save my work.\r\n\r\nThe Windows Application Event Viewer log reports the following error.\r\n\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/visioERROR.jpg\"><img class=\"aligncenter size-full wp-image-6850\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/visioERROR.jpg\" alt=\"\" width=\"674\" height=\"183\" /></a>\r\n\r\nAfter doing some research, the first thing I did was re-launch the application in safe mode by doing the following: Start --&gt; Run --&gt; visio.exe /safe\r\n\r\nThis can be done for other office applications as well that are experiencing the same symptom, Ex: winword.exe / safe, excel.exe /safe  etc\r\n\r\nBy running the application in safe mode all add-ins are disabled.  Once I did this Visio ran fine for several hours.  From there I disabled my add-ins one by one by going for File --&gt;Options --&gt; Add-ins.\r\n\r\nTurns out it was a my “send to Bluetooth” add-in,  which is not permanently disabled.','Microsoft Office Crash: Exception Code 0xc0000374, Faulting module name: ntdll.dll','','inherit','open','open','','6849-revision-2','','','2012-06-20 16:08:34','2012-06-20 16:08:34','',6849,'http://egroup.jasonmangone.com/6849-revision-2',0,'revision','',0),(6853,44,'2012-06-16 16:54:39','2012-06-16 16:54:39','So Citrix Synergy has wrapped up in San Francisco and all the news is still buzzing around. Citrix showcased many new initiatives and products and intend to touch on a very specific one here... We\'ll maybe a couple because of the integration it brings. Question for you guys. How many laptops, phones, iPad\'s, etc., do you think were running around at this conference? My guess hundreds of thousands easily, expand that to all of San Francisco and it\'s easily millions. Mobile data and even more so the mobile workforce is everywhere! The days of sitting in your cube all day has passed. People want their data and applications everywhere they go. Which raises a question... How the heck do we get all these different devices to have all of our data and applications all the time and actually function? That\'s a good question, read more to find out!<!--more-->\n\nCitrix has had a solution for some time now called CloudGateway. Straight from Citrix\'s website its description is as follows...\n\n<em>Citrix CloudGateway is an enterprise mobility management solution that aggregates, controls and delivers Windows, web, SaaS and mobile apps, and data, to any device, anywhere. CloudGateway provides end-users with a unified single point of access and self-service to all of their business apps on any device anywhere. It also provides IT with a comprehensive single point of aggregation and control for all apps, data, devices and identities.</em>\n\nThat\'s a great description and I couldn\'t have said it better myself, to put it simply... Citrix gets you your stuff where you want it! Well almost, with all the devices out there, web browsers, and everything else to deal with it has been truly difficult to get every single device on board. Citrix has been actively working to change all of that and announced at Synergy this year CloudGateway 2. CloudGateway is packed full of goodness, but the big point for me? True mobility! Citrix CloudGateway 2 is an amazingly powerful update to its enterprise mobility solution that adds extensive mobile application management capabilities, including full support for native HTML 5, iOS and Android apps. This update hooks almost all devices out there, in short they have created a monster! By utilizing the CloudGateway StoreFront you can now get to your applications from any device but what about your data? No problem! CloudGateway 2 now integrates with Citrix Sharefile. If you guys don\'t know about this product do yourself and favor and check it out <a href=\"http://www.citrix.com/english/ps2/products/product.asp?contentid=2320956\" target=\"_blank\">here</a>. Sharefile is a fantastic product allowing you to securely share your data with anyone, anywhere on any device. Do we see a trend here? Anywhere, anyone, any device. It\'s the future folks and it is here, CloudGateway 2 is here and will pave the way for your \"Corporate Mobile Revolution\". This is your easy button to the cloud, by using CloudGateway, you are able to handle all your devices through the Storefront, access and share data through Sharefile and run your application with XenApp and all of this coupled together with the Citrix Receiver. If you aren\'t utilizing the Citrix Receiver and you are a Citrix environment then shame on you! You are missing out, make sure you download it from your app store or market or whatever you use on whatever device you have! CloudGateway 2 should hit the streets in July so keep an eye out and make sure to read more <a href=\"http://www.citrix.com/English/ps2/products/product.asp?contentID=2311977\" target=\"_blank\">here</a>.','CITRIX CLOUDGATEWAY 2. LET\'S GO MOBILE','','inherit','open','open','','6826-revision-2','','','2012-06-16 16:54:39','2012-06-16 16:54:39','',6826,'http://egroup.jasonmangone.com/6826-revision-2',0,'revision','',0),(6854,32,'2012-06-21 12:47:43','2012-06-21 12:47:43','Teradici recently released firmware version 4.0.0 that has some exciting new features.  One of the updates is a result of working with Imprivata to enable Impriviata OneSign access to Zero Clients.  ZeroClients offer several advantages over thick pc\'s or even thin clients such as, ease of configuration and roll outs along with greatly reduced virus / malware foot prints.  However, many customers that use Imprivata OneSign access with card or bio readers have not been able to utilize those devices.\r\n\r\nThe recent firmware release will give Imprivata customers or customers looking towards OneSign many more options when choose devices for either VDI or share application terminals.\r\n\r\nThe link below describes some of the other upgrades and features released in this firmware version.\r\n<a href=\"http://www.teradici.com/pcoip/news-and-events/press-releases/2012-06-12.php\">http://www.teradici.com/pcoip/news-and-events/press-releases/2012-06-12.php</a>','Imprivata One Sign now on Teradici Zero Clients','','publish','open','open','','imprivata-one-sign-now-on-teradici-zero-clients','','','2012-06-21 12:51:21','2012-06-21 12:51:21','',0,'http://egroup.jasonmangone.com/?p=6854',0,'post','',0),(6855,32,'2012-06-21 02:09:42','2012-06-21 02:09:42','','Auto Draft','','inherit','open','open','','6854-revision','','','2012-06-21 02:09:42','2012-06-21 02:09:42','',6854,'http://egroup.jasonmangone.com/6854-revision',0,'revision','',0),(7036,23,'2012-07-17 14:12:23','2012-07-17 14:12:23','Yesterday, Microsoft announced SharePoint 2013 which is the next major release for SharePoint. There are lots of new features, improvements, and more in the new version. Check out the following link for more information...\r\n\r\n<a href=\"http://technet.microsoft.com/en-US/sharepoint/fp142374\" target=\"_blank\">http://technet.microsoft.com/en-US/sharepoint/fp142374</a>\r\n\r\nWhat\'s New?\r\n<ol>\r\n	<li>Search - Major enhancements here with things like contextual search and visual previews.</li>\r\n	<li>Business Intelligence - Enhancements to services like Excel, PerformancePoint, and BCS will make working with external data much easier.</li>\r\n	<li>Branding - Big enhancements in branding will make designing for SharePoint easier for web developers.</li>\r\n	<li>Development API - The API is much more powerful now with enhancements that support more external coding that will protect your environment.</li>\r\n	<li>Mobile Experience - Master pages can now be specified for device types, such as phones, tablets, etc.</li>\r\n	<li>Social Computing - Lots of focus on social features in this release that will bring your organization closer together</li>\r\n</ol>\r\nMore to come as we evaluate the customer preview that was just released!','SHAREPOINT 2013 ANNOUNCED!','','publish','open','open','','sharepoint-2013-announced','','','2012-07-17 14:13:24','2012-07-17 14:13:24','',0,'http://egroup.jasonmangone.com/?p=7036',0,'post','',0),(6857,32,'2012-06-21 12:45:28','2012-06-21 12:45:28','Teradici recently released firmware version 4.0.0 that has some exciting new features.  One of the updates is a result of working with Imprivata to enable Impriviata OneSign access to Zero Clients.  ZeroClients offer several advantages over thick pc\'s or even thin clients such as, ease of configuration and roll outs along with greatly reduced virus / malware foot prints.  However, many customers that use Imprivata OneSign access with card or bio readers have not been able to utilize those devices.\n\nThe recent firmware release will give Imprivata customers or customers looking towards OneSign many more options when choose devices for either VDI or share application terminals.\n\nThe link below describes some of the other upgrades and features released in this firmware version.\n<a href=\"http://www.teradici.com/pcoip/news-and-events/press-releases/2012-06-12.php\">http://www.teradici.com/pcoip/news-and-events/press-releases/2012-06-12.php</a>','Imprivata One Sign now on Teradici Zero Clients','','inherit','open','open','','6854-revision-2','','','2012-06-21 12:45:28','2012-06-21 12:45:28','',6854,'http://egroup.jasonmangone.com/6854-revision-2',0,'revision','',0),(6858,32,'2012-06-21 12:45:53','2012-06-21 12:45:53','Teradici recently released firmware version 4.0.0 that has some exciting new features.  One of the updates is a result of working with Imprivata to enable Impriviata OneSign access to Zero Clients.  ZeroClients offer several advantages over thick pc\'s or even thin clients such as, ease of configuration and roll outs along with greatly reduced virus / malware foot prints.  However, many customers that use Imprivata OneSign access with card or bio readers have not been able to utilize those devices.\r\n\r\nThe recent firmware release will give Imprivata customers or customers looking towards OneSign many more options when choose devices for either VDI or share application terminals.\r\n\r\nThe link below describes some of the other upgrades and features released in this firmware version.\r\n<a href=\"http://www.teradici.com/pcoip/news-and-events/press-releases/2012-06-12.php\">http://www.teradici.com/pcoip/news-and-events/press-releases/2012-06-12.php</a>','Imprivata One Sign now on Teradici Zero Clients','','inherit','open','open','','6854-revision-3','','','2012-06-21 12:45:53','2012-06-21 12:45:53','',6854,'http://egroup.jasonmangone.com/6854-revision-3',0,'revision','',0),(6859,32,'2012-06-21 12:47:43','2012-06-21 12:47:43','Teradici recently released firmware version 4.0.0 that has some exciting new features.  One of the updates is a result of working with Imprivata to enable Impriviata OneSign access to Zero Clients.  ZeroClients offer several advantages over thick pc\'s or even thin clients such as, ease of configuration and roll outs along with greatly reduced virus / malware foot prints.  However, many customers that use Imprivata OneSign access with card or bio readers have not been able to utilize those devices.\r\n\r\nThe recent firmware release will give Imprivata customers or customers looking towards OneSign many more options when choose devices for either VDI or share application terminals.\r\n\r\nThe link below describes some of the other upgrades and features released in this firmware version.\r\n<a href=\"http://www.teradici.com/pcoip/news-and-events/press-releases/2012-06-12.php\">http://www.teradici.com/pcoip/news-and-events/press-releases/2012-06-12.php</a>','Imprivata One Sign now on Teradici Zero Clients','','inherit','open','open','','6854-revision-4','','','2012-06-21 12:47:43','2012-06-21 12:47:43','',6854,'http://egroup.jasonmangone.com/6854-revision-4',0,'revision','',0),(6860,32,'2012-06-21 12:52:43','2012-06-21 12:52:43','Teradici recently released firmware version 4.0.0 that has some exciting new features.  One of the updates is a result of working with Imprivata to enable Impriviata OneSign access to Zero Clients.  ZeroClients offer several advantages over thick pc\'s or even thin clients such as, ease of configuration and roll outs along with greatly reduced virus / malware foot prints.  However, many customers that use Imprivata OneSign access with card or bio readers have not been able to utilize those devices.\n\nThe recent firmware release will give Imprivata customers or customers looking towards OneSign many more options when choose devices for either VDI or share application terminals.\n\nThe link below describes some of the other upgrades and features released in this firmware version.\n<a href=\"http://www.teradici.com/pcoip/news-and-events/press-releases/2012-06-12.php\">http://www.teradici.com/pcoip/news-and-events/press-releases/2012-06-12.php</a>','Imprivata One Sign now on Teradici Zero Clients','','inherit','open','open','','6854-autosave','','','2012-06-21 12:52:43','2012-06-21 12:52:43','',6854,'http://egroup.jasonmangone.com/6854-autosave',0,'revision','',0),(6861,29,'2012-06-20 17:22:51','2012-06-20 17:22:51','For my job I rely heavily on Microsoft Visio for design work.  So as you can image when it crashes multiple times in the same day I get a wee bit frustrated.\r\n\r\nSymptom:\r\n\r\nMicrosoft Office (Visio in this case) crashes every time I go save my work.\r\n\r\nThe Windows Application Event Viewer log reports the following error.\r\n\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/visioERROR.jpg\"><img class=\"aligncenter size-full wp-image-6850\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/visioERROR.jpg\" alt=\"\" width=\"674\" height=\"183\" /></a>\r\n\r\nAfter doing some research, the first thing I did was re-launch the application in safe mode by doing the following: Start --&gt; Run --&gt; visio.exe /safe\r\n\r\nThis can be done for other office applications as well that are experiencing the same symptom, Ex: winword.exe / safe, excel.exe /safe  etc\r\n\r\nBy running the application in safe mode all add-ins are disabled.  Once I did this Visio ran fine for several hours.  From there I disabled my add-ins one by one by going to File --&gt;Options --&gt; Add-ins.\r\n\r\nTurns out it was a my “send to Bluetooth” add-in,  which is not permanently disabled.','Microsoft Office Crash: Exception Code 0xc0000374, Faulting module name: ntdll.dll','','inherit','open','open','','6849-revision-3','','','2012-06-20 17:22:51','2012-06-20 17:22:51','',6849,'http://egroup.jasonmangone.com/6849-revision-3',0,'revision','',0),(6862,29,'2012-06-21 14:01:36','2012-06-21 14:01:36','For my job I rely heavily on Microsoft Visio for design work.  So as you can image when it crashes multiple times in the same day I get a wee bit frustrated.\n\nSymptom:\n\nMicrosoft Office (Visio in this case) crashes every time I go to save my work.\n\nThe Windows Application Event Viewer log reports the following error.\n\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/visioERROR.jpg\"><img class=\"aligncenter size-full wp-image-6850\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/visioERROR.jpg\" alt=\"\" width=\"674\" height=\"183\" /></a>\n\nAfter doing some research, the first thing I did was re-launch the application in safe mode by doing the following: Start --&gt; Run --&gt; visio.exe /safe\n\nThis can be done for other office applications as well that are experiencing the same symptom, Ex: winword.exe / safe, excel.exe /safe  etc\n\nBy running the application in safe mode all add-ins are disabled.  Once I did this Visio ran fine for several hours.  From there I disabled my add-ins one by one by going to File --&gt;Options --&gt; Add-ins.\n\nTurns out it was a my “send to Bluetooth” add-in,  which is now permanently disabled.','Microsoft Office Crash: Exception Code 0xc0000374, Faulting module name: ntdll.dll','','inherit','open','open','','6849-autosave','','','2012-06-21 14:01:36','2012-06-21 14:01:36','',6849,'http://egroup.jasonmangone.com/6849-autosave',0,'revision','',0),(6872,8,'2012-06-21 20:02:01','0000-00-00 00:00:00','Citrix Receiver/Online Plugin (AllowHotKey)\r\n\r\nThis is regarding the issue with Citrix Receiver, when launching the Citrix application through a URL, we were getting an error “Citrix online plug-in Configuration Manager: No value could be found for (Allowhotkey) that satisfies all lockdown requirements. The lockdown requirements in force may be conflicting.” After reinstalling and installing Citrix Receiver many times there was still no fix for the issue. It wasn’t until I dug deeper into the registry of my desktop. Follow these steps and you will be back to work in no time!\r\n\r\nThe following Steps will resolve this issue.\r\n<ol>\r\n	<li>Deleting the following entries under the registry location\r\n<ol>\r\n	<li>HKLM\\SOFTWARE\\Wow6432Node\\Citrix\\ICA Client\\Engine\\Lockdown Profiles\\All Regions\\Lockdown\\Virtual Channels\\Control</li>\r\n</ol>\r\n</li>\r\n	<li>Search for (AllowHotKey)\r\n<ol>\r\n	<li>Delete “AllowHotKey”</li>\r\n</ol>\r\n</li>\r\n	<li>Log back into Citrix\r\n<ol>\r\n	<li>Another error should pop up mentioning “URLRedirection”</li>\r\n	<li>Search within the registry for “URLRedirection”</li>\r\n	<li>Delete “URLRedirection”</li>\r\n</ol>\r\n</li>\r\n	<li>Log into Citrix again\r\n<ol>\r\n	<li>Another similar error should populate mentioning “ClientHostedApps”</li>\r\n	<li>Search within the registry for “ClientHostedApps”</li>\r\n	<li>Delete “ClientHostedApps”</li>\r\n</ol>\r\n</li>\r\n	<li>Log into Citrix once more, and you should be good to go!</li>\r\n</ol>','','','draft','open','open','','','','','2012-06-21 20:02:01','2012-06-21 20:02:01','',0,'http://egroup.jasonmangone.com/?p=6872',0,'post','',0),(6873,8,'2012-06-21 20:01:59','2012-06-21 20:01:59','Citrix Receiver/Online Plugin (AllowHotKey)\n\nThis is regarding the issue with Citrix Receiver, when launching the Citrix application through a URL, we were getting an error “Citrix online plug-in Configuration Manager: No value could be found for (Allowhotkey) that satisfies all lockdown requirements. The lockdown requirements in force may be conflicting.” After reinstalling and installing Citrix Receiver many times there was still no fix for the issue. It wasn’t until I dug deeper into the registry of my desktop. Follow these steps and you will be back to work in no time!\n\nThe following Steps will resolve this issue.\n<ol>\n	<li>Deleting the following entries under the registry location\n<ol>\n	<li>HKLM\\SOFTWARE\\Wow6432Node\\Citrix\\ICA Client\\Engine\\Lockdown Profiles\\All Regions\\Lockdown\\Virtual Channels\\Control</li>\n</ol>\n</li>\n	<li>Search for (AllowHotKey)\n<ol>\n	<li>Delete “AllowHotKey”</li>\n</ol>\n</li>\n	<li>Log back into Citrix\n<ol>\n	<li>Another error should pop up mentioning “URLRedirection”</li>\n	<li>Search within the registry for “URLRedirection”</li>\n	<li>Delete “URLRedirection”</li>\n</ol>\n</li>\n	<li>Log into Citrix again\n<ol>\n	<li>Another similar error should populate mentioning “ClientHostedApps”</li>\n	<li>Search within the registry for “ClientHostedApps”</li>\n	<li>Delete “ClientHostedApps”</li>\n</ol>\n</li>\n	<li>Log into Citrix once more, and you should be good to go!</li>\n</ol>','','','inherit','open','open','','6872-revision','','','2012-06-21 20:01:59','2012-06-21 20:01:59','',6872,'http://egroup.jasonmangone.com/6872-revision',0,'revision','',0),(6991,24,'2012-06-30 02:05:17','2012-06-30 02:05:17','Ran into an issue today where we could not connect via HTTPS to the ASDM on a 5512X ASA.  We had issued the following comands:\r\n\r\nASA(config)#http server enable\r\nASA(config)#asdm image disk0:/asdm-661.bin\r\n\r\nbut it still would not connect.  Internet Explorer was not giving any errors, but Chrome was showing the following:  Error 113 (net::ERR_SSL_VERSION_OR_CIPHER_MISMATCH): Unknown error.\r\n\r\nTurns out the issue is that the ASA did not enable the ciphers that my browsers were trying to use.  To fix the issue you must issue the following command:\r\n\r\nASA(config)# ssl encryption aes256-sha1 aes128-sha1 3des-sha1\r\n\r\nThis will fix the issue.  Hope this helps!','ASA Web Interface Not Working','','publish','open','open','','asa-web-interface-not-working','','','2012-06-30 02:05:17','2012-06-30 02:05:17','',0,'http://egroup.jasonmangone.com/?p=6991',0,'post','',0),(6875,38,'2012-06-21 20:04:33','2012-06-21 20:04:33','This is regarding the issue with Citrix Receiver, when launching the Citrix application through a URL, we were getting an error “Citrix online plug-in Configuration Manager: No value could be found for (Allowhotkey) that satisfies all lockdown requirements. The lockdown requirements in force may be conflicting.” After reinstalling and installing Citrix Receiver many times there was still no fix for the issue. It wasn’t until I dug deeper into the registry of my desktop. Follow these steps and you will be back to work in no time!\r\n\r\nThe following Steps will resolve this issue.\r\n<ol>\r\n	<li>Deleting the following entries under the registry location\r\n<ol>\r\n	<li>HKLM\\SOFTWARE\\Wow6432Node\\Citrix\\ICA Client\\Engine\\Lockdown Profiles\\All Regions\\Lockdown\\Virtual Channels\\Control</li>\r\n</ol>\r\n</li>\r\n	<li>Search for (AllowHotKey)\r\n<ol>\r\n	<li>Delete “AllowHotKey”</li>\r\n</ol>\r\n</li>\r\n	<li>Log back into Citrix\r\n<ol>\r\n	<li>Another error should pop up mentioning “URLRedirection”</li>\r\n	<li>Search within the registry for “URLRedirection”</li>\r\n	<li>Delete “URLRedirection”</li>\r\n</ol>\r\n</li>\r\n	<li>Log into Citrix again\r\n<ol>\r\n	<li>Another similar error should populate mentioning “ClientHostedApps”</li>\r\n	<li>Search within the registry for “ClientHostedApps”</li>\r\n	<li>Delete “ClientHostedApps”</li>\r\n</ol>\r\n</li>\r\n	<li>Log into Citrix once more, and you should be good to go.</li>\r\n</ol>\r\nWe know Citrix so if you have any other issues or questions, let us know in the comments below!\r\n\r\n<!-- Google Code for Partner\'s Home Page [Managed by template audience id 35] Conversion Page --> <script type=\"text/javascript\"> /* <![CDATA[ */ var google_conversion_id = 995397338; var google_conversion_language = \"en\"; var google_conversion_format = \"3\"; var google_conversion_color = \"ffffff\"; var google_conversion_label = \"KqqgCLbsmAQQ2p3S2gM\"; var google_conversion_value = 0; /* ]]> */ </script> <script type=\"text/javascript\" src=\"http://www.googleadservices.com/pagead/conversion.js\"> </script> <noscript> <div style=\"display:inline;\"> <img height=\"1\" width=\"1\" style=\"border-style:none;\" alt=\"\" src=\"http://www.googleadservices.com/pagead/conversion/995397338/?value=0&label=KqqgCLbsmAQQ2p3S2gM&guid=ON&script=0\"/> </div> </noscript>','Citrix Receiver/Online Plugin (AllowHotKey)','','publish','open','open','','citrix-receiveronline-plugin-allowhotkey-2','','','2013-02-26 14:45:22','2013-02-26 19:45:22','',0,'http://egroup.jasonmangone.com/?p=6875',0,'post','',12),(6876,38,'2012-06-21 20:03:24','2012-06-21 20:03:24','This is regarding the issue with Citrix Receiver, when launching the Citrix application through a URL, we were getting an error “Citrix online plug-in Configuration Manager: No value could be found for (Allowhotkey) that satisfies all lockdown requirements. The lockdown requirements in force may be conflicting.” After reinstalling and installing Citrix Receiver many times there was still no fix for the issue. It wasn’t until I dug deeper into the registry of my desktop. Follow these steps and you will be back to work in no time!\n\nThe following Steps will resolve this issue.\n<ol>\n	<li>Deleting the following entries under the registry location\n<ol>\n	<li>HKLM\\SOFTWARE\\Wow6432Node\\Citrix\\ICA Client\\Engine\\Lockdown Profiles\\All Regions\\Lockdown\\Virtual Channels\\Control</li>\n</ol>\n</li>\n	<li>Search for (AllowHotKey)\n<ol>\n	<li>Delete “AllowHotKey”</li>\n</ol>\n</li>\n	<li>Log back into Citrix\n<ol>\n	<li>Another error should pop up mentioning “URLRedirection”</li>\n	<li>Search within the registry for “URLRedirection”</li>\n	<li>Delete “URLRedirection”</li>\n</ol>\n</li>\n	<li>Log into Citrix again\n<ol>\n	<li>Another similar error should populate mentioning “ClientHostedApps”</li>\n	<li>Search within the registry for “ClientHostedApps”</li>\n	<li>Delete “ClientHostedApps”</li>\n</ol>\n</li>\n	<li>Log into Citrix once more, and you should be good to go!</li>\n</ol>','Citrix Receiver/Online Plugin (AllowHotKey)','','inherit','open','open','','6875-revision','','','2012-06-21 20:03:24','2012-06-21 20:03:24','',6875,'http://egroup.jasonmangone.com/6875-revision',0,'revision','',0),(6880,38,'2012-06-21 20:03:25','2012-06-21 20:03:25','This is regarding the issue with Citrix Receiver, when launching the Citrix application through a URL, we were getting an error “Citrix online plug-in Configuration Manager: No value could be found for (Allowhotkey) that satisfies all lockdown requirements. The lockdown requirements in force may be conflicting.” After reinstalling and installing Citrix Receiver many times there was still no fix for the issue. It wasn’t until I dug deeper into the registry of my desktop. Follow these steps and you will be back to work in no time!\r\n\r\nThe following Steps will resolve this issue.\r\n<ol>\r\n	<li>Deleting the following entries under the registry location\r\n<ol>\r\n	<li>HKLM\\SOFTWARE\\Wow6432Node\\Citrix\\ICA Client\\Engine\\Lockdown Profiles\\All Regions\\Lockdown\\Virtual Channels\\Control</li>\r\n</ol>\r\n</li>\r\n	<li>Search for (AllowHotKey)\r\n<ol>\r\n	<li>Delete “AllowHotKey”</li>\r\n</ol>\r\n</li>\r\n	<li>Log back into Citrix\r\n<ol>\r\n	<li>Another error should pop up mentioning “URLRedirection”</li>\r\n	<li>Search within the registry for “URLRedirection”</li>\r\n	<li>Delete “URLRedirection”</li>\r\n</ol>\r\n</li>\r\n	<li>Log into Citrix again\r\n<ol>\r\n	<li>Another similar error should populate mentioning “ClientHostedApps”</li>\r\n	<li>Search within the registry for “ClientHostedApps”</li>\r\n	<li>Delete “ClientHostedApps”</li>\r\n</ol>\r\n</li>\r\n	<li>Log into Citrix once more, and you should be good to go!</li>\r\n</ol>','Citrix Receiver/Online Plugin (AllowHotKey)','','inherit','open','open','','6875-revision-2','','','2012-06-21 20:03:25','2012-06-21 20:03:25','',6875,'http://egroup.jasonmangone.com/6875-revision-2',0,'revision','',0),(6881,38,'2012-06-21 20:15:26','0000-00-00 00:00:00','Search Index Corruption (Outlook 2010)\r\n\r\n&nbsp;\r\n\r\nI had been reading many post and blogs regarding an issue with users not being able to generate a complete search of their new/old emails.  For example – Say I had sent Microsoft 150+ emails over the past year, and I wanted to generate a search that would locate and list all these 150+ emails that has been sent/received (weeding out all none Microsoft related emails).  Previous to implementing this simple fix, my search result would only list 10 or so emails!  This can be very frustrating especially when the only other way to locate these past emails was the old fashion manual scroll…down hundreds of emails.\r\n\r\n<strong>Fix for Issue:</strong>\r\n\r\n<em>Rebuild the CatalogData within the Windows Exchange Search Indexer.  (Corrupt CatalogData file)</em>\r\n\r\n<!--more-->\r\n<ol>\r\n	<li>Within your Exchange Server\r\n<ol>\r\n	<li>Computer &gt; DATABASE &gt; Exchange DataBases &gt; Database1 (<em>Example 1</em>).</li>\r\n	<li>There will only be one “CatalogData” file listed if this has not been done before, if it has and there are multiple “CatalogData” files, list all as (.old).</li>\r\n	<li>Right-click on “CatalogData” file and rename (.old) at the end on the file name.</li>\r\n</ol>\r\n</li>\r\n</ol>\r\nExample 1                        <a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-1.png\"><img class=\"aligncenter  wp-image-6882\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-1.png\" alt=\"\" width=\"542\" height=\"161\" /></a>\r\n<ol>\r\n	<li>Open “Service” on desktop</li>\r\n	<li>Locate Microsoft Exchange Search Indexer (<em>Example 2</em>).</li>\r\n	<li>Click on it and on the right hand side Click Stop.</li>\r\n</ol>\r\ni.      You can test the status of your Search Indexer through the “Exchange Management Shell”.\r\n\r\nii.      Status of “Exchange Management Shell” should read as “Failed”.\r\n\r\nExample 2<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-2.png\"><img class=\"aligncenter  wp-image-6883\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-2.png\" alt=\"\" width=\"572\" height=\"123\" /></a>\r\n<ol>\r\n	<li>Test status through Exchange Management shell.\r\n<ol>\r\n	<li>Command Test-Exchange Search (when rebuild has completed result found will state True) as seen in (<em>Example 3</em>)</li>\r\n</ol>\r\n</li>\r\n</ol>\r\nExample 3<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-3.png\"><img class=\"wp-image-6884 aligncenter\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-3.png\" alt=\"\" width=\"510\" height=\"256\" /></a>\r\n<ol>\r\n	<li>The rebuilding of the “CatalogData” may take a few hours depending on the environment.\r\n<ol>\r\n	<li>Recommendation would be rebuilding during after-hours.</li>\r\n	<li>Final Step would be having the user do a clean restart of console after the CatalogData reads “True” and open outlook.</li>\r\n</ol>\r\n</li>\r\n</ol>',' ','','draft','open','open','','','','','2012-06-21 20:15:26','2012-06-21 20:15:26','',0,'http://egroup.jasonmangone.com/?p=6881',0,'post','',0),(6882,38,'2012-06-21 20:08:51','2012-06-21 20:08:51','','example 1','','inherit','open','open','','example-1','','','2012-06-21 20:08:51','2012-06-21 20:08:51','',6881,'http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-1.png',0,'attachment','image/png',0),(6883,38,'2012-06-21 20:09:43','2012-06-21 20:09:43','','example 2','','inherit','open','open','','example-2','','','2012-06-21 20:09:43','2012-06-21 20:09:43','',6881,'http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-2.png',0,'attachment','image/png',0),(6884,38,'2012-06-21 20:10:06','2012-06-21 20:10:06','','example 3','','inherit','open','open','','example-3','','','2012-06-21 20:10:06','2012-06-21 20:10:06','',6881,'http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-3.png',0,'attachment','image/png',0),(6885,38,'2012-06-21 20:06:37','2012-06-21 20:06:37','Search Index Corruption (Outlook 2010)\n\n&nbsp;\n\nI had been reading many post and blogs regarding an issue with users not being able to generate a complete search of their new/old emails.  For example – Say I had sent Microsoft 150+ emails over the past year, and I wanted to generate a search that would locate and list all these 150+ emails that has been sent/received (weeding out all none Microsoft related emails).  Previous to implementing this simple fix, my search result would only list 10 or so emails!  This can be very frustrating especially when the only other way to locate these past emails was the old fashion manual scroll…down hundreds of emails.\n\n&nbsp;\n\n<strong>Fix for Issue:</strong>\n\n&nbsp;\n\n<em>Rebuild the CatalogData within the Windows Exchange Search Indexer.  (Corrupt CatalogData file)</em>\n\n&nbsp;\n<ol>\n	<li>Within your Exchange Server\n<ol>\n	<li>Computer &gt; DATABASE &gt; Exchange DataBases &gt; Database1 (<em>Example 1</em>).</li>\n	<li>There will only be one “CatalogData” file listed if this has not been done before, if it has and there are multiple “CatalogData” files, list all as (.old).</li>\n	<li>Right-click on “CatalogData” file and rename (.old) at the end on the file name.</li>\n</ol>\n</li>\n</ol>\n&nbsp;\n\nExample 1\n\n&nbsp;\n<ol>\n	<li>Open “Service” on desktop\n<ol>\n	<li>Locate Microsoft Exchange Search Indexer (<em>Example 2</em>).</li>\n	<li>Click on it and on the right hand side Click Stop.</li>\n</ol>\n</li>\n</ol>\ni.      You can test the status of your Search Indexer through the “Exchange Management Shell”.\n\nii.      Status of “Exchange Management Shell” should read as “Failed”.\n\n&nbsp;\n\nExample 2\n\n&nbsp;\n\n&nbsp;\n<ol>\n	<li>Test status through Exchange Management shell.\n<ol>\n	<li>Command Test-Exchange Search (when rebuild has completed result found will state True) as seen in (<em>Example 3</em>).</li>\n</ol>\n</li>\n</ol>\n&nbsp;\n\nd result found will state True)l be ready for windows 7 64-bit\n\n&nbsp;\n\nExample 3\n\n&nbsp;\n\n&nbsp;\n\n&nbsp;\n<ol>\n	<li>The rebuilding of the “CatalogData” may take a few hours depending on the environment.\n<ol>\n	<li>Recommendation would be rebuilding during after-hours.</li>\n	<li>Final Step would be having the user do a clean restart of console after the CatalogData reads “True” and open outlook.</li>\n</ol>\n</li>\n</ol>','','','inherit','open','open','','6881-revision','','','2012-06-21 20:06:37','2012-06-21 20:06:37','',6881,'http://egroup.jasonmangone.com/6881-revision',0,'revision','',0),(6886,38,'2012-06-21 20:10:38','2012-06-21 20:10:38','Search Index Corruption (Outlook 2010)\n\n&nbsp;\n\nI had been reading many post and blogs regarding an issue with users not being able to generate a complete search of their new/old emails.  For example – Say I had sent Microsoft 150+ emails over the past year, and I wanted to generate a search that would locate and list all these 150+ emails that has been sent/received (weeding out all none Microsoft related emails).  Previous to implementing this simple fix, my search result would only list 10 or so emails!  This can be very frustrating especially when the only other way to locate these past emails was the old fashion manual scroll…down hundreds of emails.\n\n&nbsp;\n\n<strong>Fix for Issue:</strong>\n\n&nbsp;\n\n<em>Rebuild the CatalogData within the Windows Exchange Search Indexer.  (Corrupt CatalogData file)</em>\n\n&nbsp;\n<ol>\n	<li>Within your Exchange Server\n<ol>\n	<li>Computer &gt; DATABASE &gt; Exchange DataBases &gt; Database1 (<em>Example 1</em>).</li>\n	<li>There will only be one “CatalogData” file listed if this has not been done before, if it has and there are multiple “CatalogData” files, list all as (.old).</li>\n	<li>Right-click on “CatalogData” file and rename (.old) at the end on the file name.</li>\n</ol>\n</li>\n</ol>\n&nbsp;\n\nExample 1\n\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-1.png\"><img class=\"aligncenter  wp-image-6882\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-1.png\" alt=\"\" width=\"797\" height=\"164\" /></a>\n<ol>\n	<li>Open “Service” on desktop\n<ol>\n	<li>Locate Microsoft Exchange Search Indexer (<em>Example 2</em>).</li>\n	<li>Click on it and on the right hand side Click Stop.</li>\n</ol>\n</li>\n</ol>\ni.      You can test the status of your Search Indexer through the “Exchange Management Shell”.\n\nii.      Status of “Exchange Management Shell” should read as “Failed”.\n\n&nbsp;\n\nExample 2\n\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-2.png\"><img class=\"aligncenter size-full wp-image-6883\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-2.png\" alt=\"\" width=\"752\" height=\"123\" /></a>\n\n&nbsp;\n<ol>\n	<li>Test status through Exchange Management shell.\n<ol>\n	<li>Command Test-Exchange Search (when rebuild has completed result found will state True) as seen in (<em>Example 3</em>).</li>\n</ol>\n</li>\n</ol>\n&nbsp;\n\nd result found will state True)l be ready for windows 7 64-bit\n\n&nbsp;\n\nExample 3\n\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-3.png\"><img class=\"aligncenter size-full wp-image-6884\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-3.png\" alt=\"\" width=\"645\" height=\"258\" /></a>\n\n&nbsp;\n<ol>\n	<li>The rebuilding of the “CatalogData” may take a few hours depending on the environment.\n<ol>\n	<li>Recommendation would be rebuilding during after-hours.</li>\n	<li>Final Step would be having the user do a clean restart of console after the CatalogData reads “True” and open outlook.</li>\n</ol>\n</li>\n</ol>','','','inherit','open','open','','6881-revision-2','','','2012-06-21 20:10:38','2012-06-21 20:10:38','',6881,'http://egroup.jasonmangone.com/6881-revision-2',0,'revision','',0),(6888,38,'2012-06-21 20:29:20','2012-06-21 20:29:20','I had been reading many post and blogs regarding an issue with users not being able to generate a complete search of their new/old emails.  For example – Say I had sent Microsoft 150+ emails over the past year, and I wanted to generate a search that would locate and list all these 150+ emails that has been sent/received (weeding out all none Microsoft related emails).  Previous to implementing this simple fix, my search result would only list 10 or so emails!  This can be very frustrating especially when the only other way to locate these past emails was the old fashion manual scroll…down hundreds of emails.\r\n\r\n<strong>Fix for Issue:</strong>\r\n\r\n<em>Rebuild the CatalogData within the Windows Exchange Search Indexer.  (Corrupt CatalogData file)</em>\r\n\r\n<!--more-->\r\n\r\nWithin your Exchange Server\r\n<ol>\r\n<ol>\r\n	<li>Computer &gt; DATABASE &gt; Exchange DataBases &gt; Database1 (<em>Example 1</em>).</li>\r\n	<li>There will only be one “CatalogData” file listed if this has not been done before, if it has and there are multiple “CatalogData” files, list all as (.old).</li>\r\n	<li>Right-click on “CatalogData” file and rename (.old) at the end on the file name.</li>\r\n</ol>\r\n</ol>\r\nExample 1\r\n\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-14.png\"><img class=\"alignnone  wp-image-6894\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-14.png\" alt=\"\" width=\"586\" height=\"194\" /></a>\r\n<ol>\r\n	<li>Open “Service” on desktop\r\n<ol>\r\n	<li>Locate Microsoft Exchange Search Indexer (<em>Example 2</em>).</li>\r\n	<li>Click on it and on the right hand side Click Stop.</li>\r\n	<li>You can test the status of your Search Indexer through the “Exchange Management Shell”</li>\r\n	<li>Status of “Exchange Management Shell” should read as “Failed”.</li>\r\n</ol>\r\n</li>\r\n</ol>\r\nExample 2\r\n\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-22.png\"><img class=\"alignnone  wp-image-6897\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-22.png\" alt=\"\" width=\"555\" height=\"119\" /></a>\r\n<ol>\r\n	<li>Test status through Exchange Management shell.\r\n<ol>\r\n	<li>Command Test-Exchange Search (when rebuild has completed result found will state True) as seen in (<em>Example 3</em>).</li>\r\n</ol>\r\n</li>\r\n</ol>\r\nExample 3\r\n\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-31.png\"><img class=\"alignnone  wp-image-6898\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-31.png\" alt=\"\" width=\"547\" height=\"258\" /></a>\r\n\r\nThe rebuilding of the “CatalogData” may take a few hours depending on the environment.\r\n<ol>\r\n	<li>Recommendation would be rebuilding during after-hours.</li>\r\n	<li>Final Step: Clean restart of console after the CatalogData reads “True” &amp; open outlook.</li>\r\n</ol>','Search Index Corruption (Outlook 2010)','','publish','open','open','','search-index-corruption-outlook-2010','','','2012-06-21 20:29:20','2012-06-21 20:29:20','',0,'http://egroup.jasonmangone.com/?p=6888',0,'post','',0),(6887,38,'2012-06-21 20:11:39','2012-06-21 20:11:39','Search Index Corruption (Outlook 2010)\r\n\r\n&nbsp;\r\n\r\nI had been reading many post and blogs regarding an issue with users not being able to generate a complete search of their new/old emails.  For example – Say I had sent Microsoft 150+ emails over the past year, and I wanted to generate a search that would locate and list all these 150+ emails that has been sent/received (weeding out all none Microsoft related emails).  Previous to implementing this simple fix, my search result would only list 10 or so emails!  This can be very frustrating especially when the only other way to locate these past emails was the old fashion manual scroll…down hundreds of emails.\r\n\r\n&nbsp;\r\n\r\n<strong>Fix for Issue:</strong>\r\n\r\n&nbsp;\r\n\r\n<em>Rebuild the CatalogData within the Windows Exchange Search Indexer.  (Corrupt CatalogData file)</em>\r\n\r\n&nbsp;\r\n<ol>\r\n	<li>Within your Exchange Server\r\n<ol>\r\n	<li>Computer &gt; DATABASE &gt; Exchange DataBases &gt; Database1 (<em>Example 1</em>).</li>\r\n	<li>There will only be one “CatalogData” file listed if this has not been done before, if it has and there are multiple “CatalogData” files, list all as (.old).</li>\r\n	<li>Right-click on “CatalogData” file and rename (.old) at the end on the file name.</li>\r\n</ol>\r\n</li>\r\n</ol>\r\n&nbsp;\r\n\r\nExample 1\r\n\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-1.png\"><img class=\"aligncenter  wp-image-6882\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-1.png\" alt=\"\" width=\"542\" height=\"161\" /></a>\r\n<ol>\r\n	<li>Open “Service” on desktop\r\n<ol>\r\n	<li>Locate Microsoft Exchange Search Indexer (<em>Example 2</em>).</li>\r\n	<li>Click on it and on the right hand side Click Stop.</li>\r\n</ol>\r\n</li>\r\n</ol>\r\ni.      You can test the status of your Search Indexer through the “Exchange Management Shell”.\r\n\r\nii.      Status of “Exchange Management Shell” should read as “Failed”.\r\n\r\n&nbsp;\r\n\r\nExample 2\r\n\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-2.png\"><img class=\"aligncenter  wp-image-6883\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-2.png\" alt=\"\" width=\"572\" height=\"123\" /></a>\r\n\r\n&nbsp;\r\n<ol>\r\n	<li>Test status through Exchange Management shell.\r\n<ol>\r\n	<li>Command Test-Exchange Search (when rebuild has completed result found will state True) as seen in (<em>Example 3</em>).</li>\r\n</ol>\r\n</li>\r\n</ol>\r\n&nbsp;\r\n\r\nd result found will state True)l be ready for windows 7 64-bit\r\n\r\n&nbsp;\r\n\r\nExample 3\r\n\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-3.png\"><img class=\"wp-image-6884 aligncenter\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-3.png\" alt=\"\" width=\"510\" height=\"256\" /></a>\r\n\r\n&nbsp;\r\n<ol>\r\n	<li>The rebuilding of the “CatalogData” may take a few hours depending on the environment.\r\n<ol>\r\n	<li>Recommendation would be rebuilding during after-hours.</li>\r\n	<li>Final Step would be having the user do a clean restart of console after the CatalogData reads “True” and open outlook.</li>\r\n</ol>\r\n</li>\r\n</ol>','','','inherit','open','open','','6881-revision-3','','','2012-06-21 20:11:39','2012-06-21 20:11:39','',6881,'http://egroup.jasonmangone.com/6881-revision-3',0,'revision','',0),(6889,38,'2012-06-21 20:16:05','2012-06-21 20:16:05','Search Index Corruption (Outlook 2010)\n\n&nbsp;\n\nI had been reading many post and blogs regarding an issue with users not being able to generate a complete search of their new/old emails.  For example – Say I had sent Microsoft 150+ emails over the past year, and I wanted to generate a search that would locate and list all these 150+ emails that has been sent/received (weeding out all none Microsoft related emails).  Previous to implementing this simple fix, my search result would only list 10 or so emails!  This can be very frustrating especially when the only other way to locate these past emails was the old fashion manual scroll…down hundreds of emails.\n\n&nbsp;\n\n<strong>Fix for Issue:</strong>\n\n&nbsp;\n\n<em>Rebuild the CatalogData within the Windows Exchange Search Indexer.  (Corrupt CatalogData file)</em>\n\n&nbsp;\n<ol>\n	<li>Within your Exchange Server\n<ol>\n	<li>Computer &gt; DATABASE &gt; Exchange DataBases &gt; Database1 (<em>Example 1</em>).</li>\n	<li>There will only be one “CatalogData” file listed if this has not been done before, if it has and there are multiple “CatalogData” files, list all as (.old).</li>\n	<li>Right-click on “CatalogData” file and rename (.old) at the end on the file name.</li>\n</ol>\n</li>\n</ol>\n&nbsp;\n\nExample 1\n\n&nbsp;\n<ol>\n	<li>Open “Service” on desktop\n<ol>\n	<li>Locate Microsoft Exchange Search Indexer (<em>Example 2</em>).</li>\n	<li>Click on it and on the right hand side Click Stop.</li>\n</ol>\n</li>\n</ol>\ni.      You can test the status of your Search Indexer through the “Exchange Management Shell”.\n\nii.      Status of “Exchange Management Shell” should read as “Failed”.\n\n&nbsp;\n\nExample 2\n\n&nbsp;\n\n&nbsp;\n<ol>\n	<li>Test status through Exchange Management shell.\n<ol>\n	<li>Command Test-Exchange Search (when rebuild has completed result found will state True) as seen in (<em>Example 3</em>).</li>\n</ol>\n</li>\n</ol>\n&nbsp;\n\nd result found will state True)l be ready for windows 7 64-bit\n\n&nbsp;\n\nExample 3\n\n&nbsp;\n\n&nbsp;\n\n&nbsp;\n<ol>\n	<li>The rebuilding of the “CatalogData” may take a few hours depending on the environment.\n<ol>\n	<li>Recommendation would be rebuilding during after-hours.</li>\n	<li>Final Step would be having the user do a clean restart of console after the CatalogData reads “True” and open outlook.</li>\n</ol>\n</li>\n</ol>','','','inherit','open','open','','6888-revision','','','2012-06-21 20:16:05','2012-06-21 20:16:05','',6888,'http://egroup.jasonmangone.com/6888-revision',0,'revision','',0),(6890,38,'2012-06-21 20:17:54','2012-06-21 20:17:54','','example 1','','inherit','open','open','','example-1-2','','','2012-06-21 20:17:54','2012-06-21 20:17:54','',6888,'http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-11.png',0,'attachment','image/png',0),(6891,38,'2012-06-21 20:16:07','2012-06-21 20:16:07','Search Index Corruption (Outlook 2010)\r\n\r\n&nbsp;\r\n\r\nI had been reading many post and blogs regarding an issue with users not being able to generate a complete search of their new/old emails.  For example – Say I had sent Microsoft 150+ emails over the past year, and I wanted to generate a search that would locate and list all these 150+ emails that has been sent/received (weeding out all none Microsoft related emails).  Previous to implementing this simple fix, my search result would only list 10 or so emails!  This can be very frustrating especially when the only other way to locate these past emails was the old fashion manual scroll…down hundreds of emails.\r\n\r\n&nbsp;\r\n\r\n<strong>Fix for Issue:</strong>\r\n\r\n&nbsp;\r\n\r\n<em>Rebuild the CatalogData within the Windows Exchange Search Indexer.  (Corrupt CatalogData file)</em>\r\n\r\n&nbsp;\r\n<ol>\r\n	<li>Within your Exchange Server\r\n<ol>\r\n	<li>Computer &gt; DATABASE &gt; Exchange DataBases &gt; Database1 (<em>Example 1</em>).</li>\r\n	<li>There will only be one “CatalogData” file listed if this has not been done before, if it has and there are multiple “CatalogData” files, list all as (.old).</li>\r\n	<li>Right-click on “CatalogData” file and rename (.old) at the end on the file name.</li>\r\n</ol>\r\n</li>\r\n</ol>\r\n&nbsp;\r\n\r\nExample 1\r\n\r\n&nbsp;\r\n<ol>\r\n	<li>Open “Service” on desktop\r\n<ol>\r\n	<li>Locate Microsoft Exchange Search Indexer (<em>Example 2</em>).</li>\r\n	<li>Click on it and on the right hand side Click Stop.</li>\r\n</ol>\r\n</li>\r\n</ol>\r\ni.      You can test the status of your Search Indexer through the “Exchange Management Shell”.\r\n\r\nii.      Status of “Exchange Management Shell” should read as “Failed”.\r\n\r\n&nbsp;\r\n\r\nExample 2\r\n\r\n&nbsp;\r\n\r\n&nbsp;\r\n<ol>\r\n	<li>Test status through Exchange Management shell.\r\n<ol>\r\n	<li>Command Test-Exchange Search (when rebuild has completed result found will state True) as seen in (<em>Example 3</em>).</li>\r\n</ol>\r\n</li>\r\n</ol>\r\n&nbsp;\r\n\r\nd result found will state True)l be ready for windows 7 64-bit\r\n\r\n&nbsp;\r\n\r\nExample 3\r\n\r\n&nbsp;\r\n\r\n&nbsp;\r\n\r\n&nbsp;\r\n<ol>\r\n	<li>The rebuilding of the “CatalogData” may take a few hours depending on the environment.\r\n<ol>\r\n	<li>Recommendation would be rebuilding during after-hours.</li>\r\n	<li>Final Step would be having the user do a clean restart of console after the CatalogData reads “True” and open outlook.</li>\r\n</ol>\r\n</li>\r\n</ol>','','','inherit','open','open','','6888-revision-2','','','2012-06-21 20:16:07','2012-06-21 20:16:07','',6888,'http://egroup.jasonmangone.com/6888-revision-2',0,'revision','',0),(6892,38,'2012-06-21 20:19:28','2012-06-21 20:19:28','','example 1','','inherit','open','open','','example-1-3','','','2012-06-21 20:19:28','2012-06-21 20:19:28','',6888,'http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-12.png',0,'attachment','image/png',0),(6893,38,'2012-06-21 20:20:08','2012-06-21 20:20:08','','example 1','','inherit','open','open','','example-1-4','','','2012-06-21 20:20:08','2012-06-21 20:20:08','',6888,'http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-13.png',0,'attachment','image/png',0),(6894,38,'2012-06-21 20:20:50','2012-06-21 20:20:50','','example 1','','inherit','open','open','','example-1-5','','','2012-06-21 20:20:50','2012-06-21 20:20:50','',6888,'http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-14.png',0,'attachment','image/png',0),(6895,38,'2012-06-21 20:19:01','2012-06-21 20:19:01','I had been reading many post and blogs regarding an issue with users not being able to generate a complete search of their new/old emails.  For example – Say I had sent Microsoft 150+ emails over the past year, and I wanted to generate a search that would locate and list all these 150+ emails that has been sent/received (weeding out all none Microsoft related emails).  Previous to implementing this simple fix, my search result would only list 10 or so emails!  This can be very frustrating especially when the only other way to locate these past emails was the old fashion manual scroll…down hundreds of emails.\r\n\r\n<strong>Fix for Issue:</strong>\r\n\r\n<em>Rebuild the CatalogData within the Windows Exchange Search Indexer.  (Corrupt CatalogData file)</em>\r\n\r\n<!--more-->\r\n\r\n&nbsp;\r\n<ol>\r\n	<li>Within your Exchange Server\r\n<ol>\r\n	<li>Computer &gt; DATABASE &gt; Exchange DataBases &gt; Database1 (<em>Example 1</em>).</li>\r\n	<li>There will only be one “CatalogData” file listed if this has not been done before, if it has and there are multiple “CatalogData” files, list all as (.old).</li>\r\n	<li>Right-click on “CatalogData” file and rename (.old) at the end on the file name.</li>\r\n</ol>\r\n</li>\r\n</ol>\r\nExample 1\r\n\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-11.png\"><img class=\"alignleft  wp-image-6890\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-11.png\" alt=\"\" width=\"806\" height=\"190\" /></a>\r\n<ol>\r\n	<li>Open “Service” on desktop\r\n<ol>\r\n	<li>Locate Microsoft Exchange Search Indexer (<em>Example 2</em>).</li>\r\n	<li>Click on it and on the right hand side Click Stop.</li>\r\n	<li>You can test the status of your Search Indexer through the “Exchange Management Shell”</li>\r\n	<li> Status of “Exchange Management Shell” should read as “Failed”.</li>\r\n</ol>\r\n</li>\r\n</ol>\r\n&nbsp;\r\n\r\nExample 2\r\n\r\n&nbsp;\r\n\r\n&nbsp;\r\n<ol>\r\n	<li>Test status through Exchange Management shell.\r\n<ol>\r\n	<li>Command Test-Exchange Search (when rebuild has completed result found will state True) as seen in (<em>Example 3</em>).</li>\r\n</ol>\r\n</li>\r\n</ol>\r\n&nbsp;\r\n\r\nd result found will state True)l be ready for windows 7 64-bit\r\n\r\n&nbsp;\r\n\r\nExample 3\r\n\r\n&nbsp;\r\n\r\n&nbsp;\r\n\r\n&nbsp;\r\n<ol>\r\n	<li>The rebuilding of the “CatalogData” may take a few hours depending on the environment.\r\n<ol>\r\n	<li>Recommendation would be rebuilding during after-hours.</li>\r\n	<li>Final Step would be having the user do a clean restart of console after the CatalogData reads “True” and open outlook.</li>\r\n</ol>\r\n</li>\r\n</ol>','Search Index Corruption (Outlook 2010)','','inherit','open','open','','6888-revision-3','','','2012-06-21 20:19:01','2012-06-21 20:19:01','',6888,'http://egroup.jasonmangone.com/6888-revision-3',0,'revision','',0),(6896,38,'2012-06-21 20:22:45','2012-06-21 20:22:45','','example 2','','inherit','open','open','','example-2-2','','','2012-06-21 20:22:45','2012-06-21 20:22:45','',6888,'http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-21.png',0,'attachment','image/png',0),(6897,38,'2012-06-21 20:23:18','2012-06-21 20:23:18','','example 2','','inherit','open','open','','example-2-3','','','2012-06-21 20:23:18','2012-06-21 20:23:18','',6888,'http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-22.png',0,'attachment','image/png',0),(6898,38,'2012-06-21 20:24:35','2012-06-21 20:24:35','','example 3','','inherit','open','open','','example-3-2','','','2012-06-21 20:24:35','2012-06-21 20:24:35','',6888,'http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-31.png',0,'attachment','image/png',0),(6899,38,'2012-06-21 20:21:23','2012-06-21 20:21:23','I had been reading many post and blogs regarding an issue with users not being able to generate a complete search of their new/old emails.  For example – Say I had sent Microsoft 150+ emails over the past year, and I wanted to generate a search that would locate and list all these 150+ emails that has been sent/received (weeding out all none Microsoft related emails).  Previous to implementing this simple fix, my search result would only list 10 or so emails!  This can be very frustrating especially when the only other way to locate these past emails was the old fashion manual scroll…down hundreds of emails.\r\n\r\n<strong>Fix for Issue:</strong>\r\n\r\n<em>Rebuild the CatalogData within the Windows Exchange Search Indexer.  (Corrupt CatalogData file)</em>\r\n\r\n<!--more-->\r\n\r\n&nbsp;\r\n<ol>\r\n	<li>Within your Exchange Server\r\n<ol>\r\n	<li>Computer &gt; DATABASE &gt; Exchange DataBases &gt; Database1 (<em>Example 1</em>).</li>\r\n	<li>There will only be one “CatalogData” file listed if this has not been done before, if it has and there are multiple “CatalogData” files, list all as (.old).</li>\r\n	<li>Right-click on “CatalogData” file and rename (.old) at the end on the file name.</li>\r\n</ol>\r\n</li>\r\n</ol>\r\nExample 1\r\n\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-14.png\"><img class=\"alignnone  wp-image-6894\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-14.png\" alt=\"\" width=\"626\" height=\"194\" /></a>\r\n<ol>\r\n	<li>Open “Service” on desktop\r\n<ol>\r\n	<li>Locate Microsoft Exchange Search Indexer (<em>Example 2</em>).</li>\r\n	<li>Click on it and on the right hand side Click Stop.</li>\r\n	<li>You can test the status of your Search Indexer through the “Exchange Management Shell”</li>\r\n	<li> Status of “Exchange Management Shell” should read as “Failed”.</li>\r\n</ol>\r\n</li>\r\n</ol>\r\n&nbsp;\r\n\r\nExample 2\r\n\r\n&nbsp;\r\n\r\n&nbsp;\r\n<ol>\r\n	<li>Test status through Exchange Management shell.\r\n<ol>\r\n	<li>Command Test-Exchange Search (when rebuild has completed result found will state True) as seen in (<em>Example 3</em>).</li>\r\n</ol>\r\n</li>\r\n</ol>\r\n&nbsp;\r\n\r\nd result found will state True)l be ready for windows 7 64-bit\r\n\r\n&nbsp;\r\n\r\nExample 3\r\n\r\n&nbsp;\r\n\r\n&nbsp;\r\n\r\n&nbsp;\r\n<ol>\r\n	<li>The rebuilding of the “CatalogData” may take a few hours depending on the environment.\r\n<ol>\r\n	<li>Recommendation would be rebuilding during after-hours.</li>\r\n	<li>Final Step would be having the user do a clean restart of console after the CatalogData reads “True” and open outlook.</li>\r\n</ol>\r\n</li>\r\n</ol>','Search Index Corruption (Outlook 2010)','','inherit','open','open','','6888-revision-4','','','2012-06-21 20:21:23','2012-06-21 20:21:23','',6888,'http://egroup.jasonmangone.com/6888-revision-4',0,'revision','',0),(6902,38,'2012-06-21 20:28:53','2012-06-21 20:28:53','I had been reading many post and blogs regarding an issue with users not being able to generate a complete search of their new/old emails.  For example – Say I had sent Microsoft 150+ emails over the past year, and I wanted to generate a search that would locate and list all these 150+ emails that has been sent/received (weeding out all none Microsoft related emails).  Previous to implementing this simple fix, my search result would only list 10 or so emails!  This can be very frustrating especially when the only other way to locate these past emails was the old fashion manual scroll…down hundreds of emails.\r\n\r\n<strong>Fix for Issue:</strong>\r\n\r\n<em>Rebuild the CatalogData within the Windows Exchange Search Indexer.  (Corrupt CatalogData file)</em>\r\n\r\n<!--more-->\r\n\r\nWithin your Exchange Server\r\n<ol>\r\n<ol>\r\n	<li>Computer &gt; DATABASE &gt; Exchange DataBases &gt; Database1 (<em>Example 1</em>).</li>\r\n	<li>There will only be one “CatalogData” file listed if this has not been done before, if it has and there are multiple “CatalogData” files, list all as (.old).</li>\r\n	<li>Right-click on “CatalogData” file and rename (.old) at the end on the file name.</li>\r\n</ol>\r\n</ol>\r\nExample 1\r\n\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-14.png\"><img class=\"alignnone  wp-image-6894\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-14.png\" alt=\"\" width=\"586\" height=\"194\" /></a>\r\n<ol>\r\n	<li>Open “Service” on desktop\r\n<ol>\r\n	<li>Locate Microsoft Exchange Search Indexer (<em>Example 2</em>).</li>\r\n	<li>Click on it and on the right hand side Click Stop.</li>\r\n	<li>You can test the status of your Search Indexer through the “Exchange Management Shell”</li>\r\n	<li> Status of “Exchange Management Shell” should read as “Failed”.</li>\r\n</ol>\r\n</li>\r\n</ol>\r\nExample 2\r\n\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-22.png\"><img class=\"alignnone  wp-image-6897\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-22.png\" alt=\"\" width=\"555\" height=\"119\" /></a>\r\n<ol>\r\n	<li>Test status through Exchange Management shell.\r\n<ol>\r\n	<li>Command Test-Exchange Search (when rebuild has completed result found will state True) as seen in (<em>Example 3</em>).</li>\r\n</ol>\r\n</li>\r\n</ol>\r\nExample 3\r\n\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-31.png\"><img class=\"alignnone  wp-image-6898\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-31.png\" alt=\"\" width=\"547\" height=\"258\" /></a>\r\n\r\nThe rebuilding of the “CatalogData” may take a few hours depending on the environment.\r\n<ol>\r\n	<li>Recommendation would be rebuilding during after-hours.</li>\r\n	<li>Final Step: Clean restart of console after the CatalogData reads “True” &amp; open outlook.</li>\r\n</ol>','Search Index Corruption (Outlook 2010)','','inherit','open','open','','6888-revision-7','','','2012-06-21 20:28:53','2012-06-21 20:28:53','',6888,'http://egroup.jasonmangone.com/6888-revision-7',0,'revision','',0),(6900,38,'2012-06-21 20:25:14','2012-06-21 20:25:14','I had been reading many post and blogs regarding an issue with users not being able to generate a complete search of their new/old emails.  For example – Say I had sent Microsoft 150+ emails over the past year, and I wanted to generate a search that would locate and list all these 150+ emails that has been sent/received (weeding out all none Microsoft related emails).  Previous to implementing this simple fix, my search result would only list 10 or so emails!  This can be very frustrating especially when the only other way to locate these past emails was the old fashion manual scroll…down hundreds of emails.\r\n\r\n<strong>Fix for Issue:</strong>\r\n\r\n<em>Rebuild the CatalogData within the Windows Exchange Search Indexer.  (Corrupt CatalogData file)</em>\r\n\r\n<!--more-->\r\n\r\n&nbsp;\r\n<ol>\r\n	<li>Within your Exchange Server\r\n<ol>\r\n	<li>Computer &gt; DATABASE &gt; Exchange DataBases &gt; Database1 (<em>Example 1</em>).</li>\r\n	<li>There will only be one “CatalogData” file listed if this has not been done before, if it has and there are multiple “CatalogData” files, list all as (.old).</li>\r\n	<li>Right-click on “CatalogData” file and rename (.old) at the end on the file name.</li>\r\n</ol>\r\n</li>\r\n</ol>\r\nExample 1\r\n\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-14.png\"><img class=\"alignnone  wp-image-6894\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-14.png\" alt=\"\" width=\"586\" height=\"194\" /></a>\r\n<ol>\r\n	<li>Open “Service” on desktop\r\n<ol>\r\n	<li>Locate Microsoft Exchange Search Indexer (<em>Example 2</em>).</li>\r\n	<li>Click on it and on the right hand side Click Stop.</li>\r\n	<li>You can test the status of your Search Indexer through the “Exchange Management Shell”</li>\r\n	<li> Status of “Exchange Management Shell” should read as “Failed”.</li>\r\n</ol>\r\n</li>\r\n</ol>\r\nExample 2\r\n\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-22.png\"><img class=\"alignnone  wp-image-6897\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-22.png\" alt=\"\" width=\"555\" height=\"119\" /></a>\r\n<ol>\r\n	<li>Test status through Exchange Management shell.\r\n<ol>\r\n	<li>Command Test-Exchange Search (when rebuild has completed result found will state True) as seen in (<em>Example 3</em>).</li>\r\n</ol>\r\n</li>\r\n</ol>\r\nExample 3\r\n\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-31.png\"><img class=\"alignnone  wp-image-6898\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-31.png\" alt=\"\" width=\"547\" height=\"258\" /></a>\r\n\r\n&nbsp;\r\n\r\nThe rebuilding of the “CatalogData” may take a few hours depending on the environment.\r\n<ol>\r\n	<li>Recommendation would be rebuilding during after-hours.</li>\r\n	<li>Final Step would be having the user do a clean restart of console after the CatalogData reads “True” and open outlook.</li>\r\n</ol>','Search Index Corruption (Outlook 2010)','','inherit','open','open','','6888-revision-5','','','2012-06-21 20:25:14','2012-06-21 20:25:14','',6888,'http://egroup.jasonmangone.com/6888-revision-5',0,'revision','',0),(6901,38,'2012-06-21 20:27:30','2012-06-21 20:27:30','I had been reading many post and blogs regarding an issue with users not being able to generate a complete search of their new/old emails.  For example – Say I had sent Microsoft 150+ emails over the past year, and I wanted to generate a search that would locate and list all these 150+ emails that has been sent/received (weeding out all none Microsoft related emails).  Previous to implementing this simple fix, my search result would only list 10 or so emails!  This can be very frustrating especially when the only other way to locate these past emails was the old fashion manual scroll…down hundreds of emails.\r\n\r\n<strong>Fix for Issue:</strong>\r\n\r\n<em>Rebuild the CatalogData within the Windows Exchange Search Indexer.  (Corrupt CatalogData file)</em>\r\n\r\n<!--more-->\r\n\r\n&nbsp;\r\n<ol>\r\n	<li>Within your Exchange Server\r\n<ol>\r\n	<li>Computer &gt; DATABASE &gt; Exchange DataBases &gt; Database1 (<em>Example 1</em>).</li>\r\n	<li>There will only be one “CatalogData” file listed if this has not been done before, if it has and there are multiple “CatalogData” files, list all as (.old).</li>\r\n	<li>Right-click on “CatalogData” file and rename (.old) at the end on the file name.</li>\r\n</ol>\r\n</li>\r\n</ol>\r\nExample 1\r\n\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-14.png\"><img class=\"alignnone  wp-image-6894\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-14.png\" alt=\"\" width=\"586\" height=\"194\" /></a>\r\n<ol>\r\n	<li>Open “Service” on desktop\r\n<ol>\r\n	<li>Locate Microsoft Exchange Search Indexer (<em>Example 2</em>).</li>\r\n	<li>Click on it and on the right hand side Click Stop.</li>\r\n	<li>You can test the status of your Search Indexer through the “Exchange Management Shell”</li>\r\n	<li> Status of “Exchange Management Shell” should read as “Failed”.</li>\r\n</ol>\r\n</li>\r\n</ol>\r\nExample 2\r\n\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-22.png\"><img class=\"alignnone  wp-image-6897\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-22.png\" alt=\"\" width=\"555\" height=\"119\" /></a>\r\n<ol>\r\n	<li>Test status through Exchange Management shell.\r\n<ol>\r\n	<li>Command Test-Exchange Search (when rebuild has completed result found will state True) as seen in (<em>Example 3</em>).</li>\r\n</ol>\r\n</li>\r\n</ol>\r\nExample 3\r\n\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-31.png\"><img class=\"alignnone  wp-image-6898\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/example-31.png\" alt=\"\" width=\"547\" height=\"258\" /></a>\r\n\r\nThe rebuilding of the “CatalogData” may take a few hours depending on the environment.\r\n<ol>\r\n	<li>Recommendation would be rebuilding during after-hours.</li>\r\n	<li>Final Step: Clean restart of console after the CatalogData reads “True” &amp; open outlook.</li>\r\n</ol>','Search Index Corruption (Outlook 2010)','','inherit','open','open','','6888-revision-6','','','2012-06-21 20:27:30','2012-06-21 20:27:30','',6888,'http://egroup.jasonmangone.com/6888-revision-6',0,'revision','',0),(6909,35,'2012-06-25 05:33:54','2012-06-25 05:33:54','VMware released the <a href=\"http://communities.vmware.com/docs/DOC-19605\">vSphere 5.0 Hardening Guide</a> this month and I wanted to take the opportunity to blog my way through it in order to increase my familiarity, heighten its visibility, and provide a forum for discussion of the recommendations and methods to implement an assessment in your own environment.\n\nSince the hypervisor is the heart of your datacenter, let\'s start with the ESXi guidelines:\n<ul>\n	<li>Guideline Title: Use Active Directory for local user authentication\n<ul>\n	<li>Title: enable-ad-auth</li>\n	<li>Discussion: The credentials to your ESXi hosts are among the most sensitive in your entire datacenter. The root password should only be given to personnel that have an explicit need for it. Other users that need to login to hosts outside of vCenter can have permissions granted to their Active Directory account. David Davis has a <a href=\"http://blogs.vmware.com/esxi/2011/01/esxi-41-active-directory-integration.html\">great video</a> demonstrating the process. By default, an AD group names \"ESX Admins\" is checked for and all members will have full rights to all hosts.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc_50%2FGUID-25A5EB3B-7BB1-4B0B-9323-926AE6F0667F.html\">Official VMware documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title: Establish a password policy for password complexity\n<ul>\n	<li>Title: set-password-complexity</li>\n	<li>Discussion: This setting is used to enforce strong passwords for local accounts. You know, the local accounts you\'re not using since all your hosts are joined to AD, right? But seriously, this is a great setting to use to force users to pick strong passwords, even if your hosts have no local users. Configuration drift happens, so let\'s plan ahead and make sure these users will have strong passwords. Using vi, you\'ll edit the file /etc/pam.d/passwd and modify the third line. The default value is \"password requisite /lib/security/$ISA/pam_passwdqc.so retry=3 min=8,8,8,7,6\". The retry value controls how many attempts users get to pick a strong password. The last 5 numbers control your desired complexity settings, in the following order and referencing four character classes (uppercase letters, lowercase letters, numbers, and symbols/special characters):\n<ul>\n	<li>The first digit is the minimum length for passwords containing characters from 1 of the classes (least complex, e.g. using \"password\" as your password). You\'ll want this to be a very large number.</li>\n	<li>The second digit is the minimum length for password containing characters from 2 of the classes. You\'ll also want this to be a very large number.</li>\n	<li>The third digit is the minimum length of SSL certificate passphrases</li>\n	<li>The fourth digit is the minimum length for password containing characters from 3 of the classes. Now were getting into reasonable passwords, so allow whatever reasonable length your organization permits.</li>\n	<li>The fifth digit is the minimum length for password containing characters from 4 of the classes (most complex, e.g. using \"p4$wOrd\" as your password\"). Same as the previous line.</li>\n</ul>\n</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc_50%2FGUID-942E8E23-D2CE-49B0-8B39-F31EF6D0519B.html\">Official VMware documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title: Verify Active Directory \"ESX Admin\" group membership.\n<ul>\n	<li>Title: verify-admin-group</li>\n	<li>Discussion: now that our hosts are joined to AD (first bullet point above), we want to audit the membership of \"ESX Admins\" since those users will automatically have root-level permissions to our hosts. This is a manual check, but you\'ll also want to automate it so that it can run regularly. You can write a scheduled Powershell script to read the group membership and email you the contents on a schedule, or products like ADAudit Plus from ManageEngine are perfect for this task and can email you only when group membership changes.</li>\n	<li><a href=\"http://kb.vmware.com/kb/1025569\">Official VMware documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title: Ensure that vpxuser auto-password change meets policy.\n<ul>\n	<li>Title: vpxuser-password-age</li>\n	<li>Discussion: ESXi contains a built-in user account called vpxuser. This account has Administrator-level permissions to the local host and is used by vCenter to execute tasks. vCenter sets this password and changes it automatically every 30 days. If your organization requires more frequent password changes, you can change this from the vSphere client by selecting \"Administration -&gt; vCenter Server Settings -&gt; Advanced Settings\" and changing VirtualCenter.VimPasswordExpirationInDays to your desired interval.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc_50%2FGUID-20FA4157-F371-4922-92E8-63822FA808FA.html\">Official VMware Documentation</a></li>\n</ul>\n</li>\n	<li> Guideline Title: Ensure that vpxuser password meets length policy.\n<ul>\n	<li>Title:vpxuser-password-length</li>\n	<li>Discussion: Similar to the guideline above, this check confirms that the password length for the vpxuser password is long enough to comply with your organization\'s security policy. By default it is set to 32 characters. To increase this password length, modify the \"vpxd.hostPasswordLength\" value in the vpxd.cfg file. On Windows this file is located at C:\\Documents and Settings\\All Users\\Application Data\\VMware\\VMware VirtualCenter\\vpxd.cfg  or on the vCenter Server Appliance you\'ll find it at /etc/vmware-vpx/vpxd.cfg.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc_50%2FGUID-20FA4157-F371-4922-92E8-63822FA808FA.html\">Official VMware documentation</a></li>\n</ul>\n</li>\n</ul>\nThat\'s it for today! I\'ll see you all back here tomorrow to continue','VSPHERE HARDENING - PART 1','','inherit','open','open','','6904-revision-5','','','2012-06-25 05:33:54','2012-06-25 05:33:54','',6904,'http://egroup.jasonmangone.com/6904-revision-5',0,'revision','',0),(6910,35,'2012-06-25 05:35:44','2012-06-25 05:35:44','VMware released the <a href=\"http://communities.vmware.com/docs/DOC-19605\">vSphere 5.0 Hardening Guide</a> this month and I wanted to take the opportunity to blog my way through it in order to increase my familiarity, heighten its visibility, and provide a forum for discussion of the recommendations and methods to implement an assessment in your own environment.\n\nSince the hypervisor is the heart of your datacenter, let\'s start with the ESXi guidelines:\n<ul>\n	<li>Guideline Title: Use Active Directory for local user authentication\n<ul>\n	<li>Title: enable-ad-auth</li>\n	<li>Discussion: The credentials to your ESXi hosts are among the most sensitive in your entire datacenter. The root password should only be given to personnel that have an explicit need for it. Other users that need to login to hosts outside of vCenter can have permissions granted to their Active Directory account. David Davis has a <a href=\"http://blogs.vmware.com/esxi/2011/01/esxi-41-active-directory-integration.html\">great video</a> demonstrating the process. By default, an AD group names \"ESX Admins\" is checked for and all members will have full rights to all hosts.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc_50%2FGUID-25A5EB3B-7BB1-4B0B-9323-926AE6F0667F.html\">Official VMware documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title: Establish a password policy for password complexity\n<ul>\n	<li>Title: set-password-complexity</li>\n	<li>Discussion: This setting is used to enforce strong passwords for local accounts. You know, the local accounts you\'re not using since all your hosts are joined to AD, right? But seriously, this is a great setting to use to force users to pick strong passwords, even if your hosts have no local users. Configuration drift happens, so let\'s plan ahead and make sure these users will have strong passwords. Using vi, you\'ll edit the file /etc/pam.d/passwd and modify the third line. The default value is \"password requisite /lib/security/$ISA/pam_passwdqc.so retry=3 min=8,8,8,7,6\". The retry value controls how many attempts users get to pick a strong password. The last 5 numbers control your desired complexity settings, in the following order and referencing four character classes (uppercase letters, lowercase letters, numbers, and symbols/special characters):\n<ul>\n	<li>The first digit is the minimum length for passwords containing characters from 1 of the classes (least complex, e.g. using \"password\" as your password). You\'ll want this to be a very large number.</li>\n	<li>The second digit is the minimum length for password containing characters from 2 of the classes. You\'ll also want this to be a very large number.</li>\n	<li>The third digit is the minimum length of SSL certificate passphrases</li>\n	<li>The fourth digit is the minimum length for password containing characters from 3 of the classes. Now were getting into reasonable passwords, so allow whatever reasonable length your organization permits.</li>\n	<li>The fifth digit is the minimum length for password containing characters from 4 of the classes (most complex, e.g. using \"p4$wOrd\" as your password\"). Same as the previous line.</li>\n</ul>\n</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc_50%2FGUID-942E8E23-D2CE-49B0-8B39-F31EF6D0519B.html\">Official VMware documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title: Verify Active Directory \"ESX Admin\" group membership.\n<ul>\n	<li>Title: verify-admin-group</li>\n	<li>Discussion: now that our hosts are joined to AD (first bullet point above), we want to audit the membership of \"ESX Admins\" since those users will automatically have root-level permissions to our hosts. This is a manual check, but you\'ll also want to automate it so that it can run regularly. You can write a scheduled Powershell script to read the group membership and email you the contents on a schedule, or products like ADAudit Plus from ManageEngine are perfect for this task and can email you only when group membership changes.</li>\n	<li><a href=\"http://kb.vmware.com/kb/1025569\">Official VMware documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title: Ensure that vpxuser auto-password change meets policy.\n<ul>\n	<li>Title: vpxuser-password-age</li>\n	<li>Discussion: ESXi contains a built-in user account called vpxuser. This account has Administrator-level permissions to the local host and is used by vCenter to execute tasks. vCenter sets this password and changes it automatically every 30 days. If your organization requires more frequent password changes, you can change this from the vSphere client by selecting \"Administration -&gt; vCenter Server Settings -&gt; Advanced Settings\" and changing VirtualCenter.VimPasswordExpirationInDays to your desired interval.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc_50%2FGUID-20FA4157-F371-4922-92E8-63822FA808FA.html\">Official VMware Documentation</a></li>\n</ul>\n</li>\n	<li> Guideline Title: Ensure that vpxuser password meets length policy.\n<ul>\n	<li>Title:vpxuser-password-length</li>\n	<li>Discussion: Similar to the guideline above, this check confirms that the password length for the vpxuser password is long enough to comply with your organization\'s security policy. By default it is set to 32 characters. To increase this password length, modify the \"vpxd.hostPasswordLength\" value in the vpxd.cfg file. On Windows this file is located at C:\\Documents and Settings\\All Users\\Application Data\\VMware\\VMware VirtualCenter\\vpxd.cfg  or on the vCenter Server Appliance you\'ll find it at /etc/vmware-vpx/vpxd.cfg.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc_50%2FGUID-20FA4157-F371-4922-92E8-63822FA808FA.html\">Official VMware documentation</a></li>\n</ul>\n</li>\n</ul>\nThat\'s it for today! I\'ll see you all back here tomorrow to continue our discussion on the vSphere 5.0 Hardening Guide.','VSPHERE 5.0 HARDENING GUIDE DISCUSSION - PART 1','','inherit','open','open','','6904-revision-6','','','2012-06-25 05:35:44','2012-06-25 05:35:44','',6904,'http://egroup.jasonmangone.com/6904-revision-6',0,'revision','',0),(6911,35,'2012-06-26 03:05:15','2012-06-26 03:05:15','VMware released the <a href=\"http://communities.vmware.com/docs/DOC-19605\">vSphere 5.0 Hardening Guide</a> this month and I wanted to take the opportunity to blog my way through it in order to increase my familiarity, heighten its visibility, and provide a forum for discussion of the recommendations and methods to implement an assessment in your own environment.\n\nSince the hypervisor is the heart of your datacenter, let\'s start with the ESXi guidelines:\n<ul>\n	<li>Guideline Title: Use Active Directory for local user authentication\n<ul>\n	<li>Title: enable-ad-auth</li>\n	<li>Discussion: The credentials to your ESXi hosts are among the most sensitive in your entire datacenter. The root password should only be given to personnel that have an explicit need for it. Other users that need to login to hosts outside of vCenter can have permissions granted to their Active Directory account. David Davis has a <a href=\"http://blogs.vmware.com/esxi/2011/01/esxi-41-active-directory-integration.html\">great video</a> demonstrating the process. By default, an AD group names \"ESX Admins\" is checked for and all members will have full rights to all hosts.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc_50%2FGUID-25A5EB3B-7BB1-4B0B-9323-926AE6F0667F.html\">Official VMware documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title: Establish a password policy for password complexity\n<ul>\n	<li>Title: set-password-complexity</li>\n	<li>Discussion: This setting is used to enforce strong passwords for local accounts. You know, the local accounts you\'re not using since all your hosts are joined to AD, right? But seriously, this is a great setting to use to force users to pick strong passwords, even if your hosts have no local users. Configuration drift happens, so let\'s plan ahead and make sure these users will have strong passwords. Using vi, you\'ll edit the file /etc/pam.d/passwd and modify the third line. The default value is \"password requisite /lib/security/$ISA/pam_passwdqc.so retry=3 min=8,8,8,7,6\". The retry value controls how many attempts users get to pick a strong password. The last 5 numbers control your desired complexity settings, in the following order and referencing four character classes (uppercase letters, lowercase letters, numbers, and symbols/special characters):\n<ul>\n	<li>The first digit is the minimum length for passwords containing characters from 1 of the classes (least complex, e.g. using \"password\" as your password). You\'ll want this to be a very large number.</li>\n	<li>The second digit is the minimum length for password containing characters from 2 of the classes. You\'ll also want this to be a very large number.</li>\n	<li>The third digit is the minimum length of SSL certificate passphrases</li>\n	<li>The fourth digit is the minimum length for password containing characters from 3 of the classes. Now were getting into reasonable passwords, so allow whatever reasonable length your organization permits.</li>\n	<li>The fifth digit is the minimum length for password containing characters from 4 of the classes (most complex, e.g. using \"p4$wOrd\" as your password\"). Same as the previous line.</li>\n</ul>\n</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc_50%2FGUID-942E8E23-D2CE-49B0-8B39-F31EF6D0519B.html\">Official VMware documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title: Verify Active Directory \"ESX Admin\" group membership.\n<ul>\n	<li>Title: verify-admin-group</li>\n	<li>Discussion: now that our hosts are joined to AD (first bullet point above), we want to audit the membership of \"ESX Admins\" since those users will automatically have root-level permissions to our hosts. This is a manual check, but you\'ll also want to automate it so that it can run regularly. You can write a scheduled Powershell script to read the group membership and email you the contents on a schedule, or products like ADAudit Plus from ManageEngine are perfect for this task and can email you only when group membership changes.</li>\n	<li><a href=\"http://kb.vmware.com/kb/1025569\">Official VMware documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title: Ensure that vpxuser auto-password change meets policy.\n<ul>\n	<li>Title: vpxuser-password-age</li>\n	<li>Discussion: ESXi contains a built-in user account called vpxuser. This account has Administrator-level permissions to the local host and is used by vCenter to execute tasks. vCenter sets this password and changes it automatically every 30 days. If your organization requires more frequent password changes, you can change this from the vSphere client by selecting \"Administration -&gt; vCenter Server Settings -&gt; Advanced Settings\" and changing VirtualCenter.VimPasswordExpirationInDays to your desired interval.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc_50%2FGUID-20FA4157-F371-4922-92E8-63822FA808FA.html\">Official VMware documentation</a></li>\n</ul>\n</li>\n	<li> Guideline Title: Ensure that vpxuser password meets length policy.\n<ul>\n	<li>Title:vpxuser-password-length</li>\n	<li>Discussion: Similar to the guideline above, this check confirms that the password length for the vpxuser password is long enough to comply with your organization\'s security policy. By default it is set to 32 characters. To increase this password length, modify the \"vpxd.hostPasswordLength\" value in the vpxd.cfg file. On Windows this file is located at C:\\Documents and Settings\\All Users\\Application Data\\VMware\\VMware VirtualCenter\\vpxd.cfg  or on the vCenter Server Appliance you\'ll find it at /etc/vmware-vpx/vpxd.cfg.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc_50%2FGUID-20FA4157-F371-4922-92E8-63822FA808FA.html\">Official VMware documentation</a></li>\n</ul>\n</li>\n</ul>\nThat\'s it for today! I\'ll see you all back here tomorrow to continue our discussion on the vSphere 5.0 Hardening Guide.','VSPHERE 5.0 HARDENING GUIDE DISCUSSION - PART 1','','inherit','open','open','','6904-autosave','','','2012-06-26 03:05:15','2012-06-26 03:05:15','',6904,'http://egroup.jasonmangone.com/6904-autosave',0,'revision','',0),(7004,2,'2012-07-05 14:01:25','2012-07-05 14:01:25','Join us for the upcoming North Carolina Triad VMUG meeting taking place on Friday, July 13, 2012.\r\n\r\n<a href=\"http://www.vmug.com/e/in/eid=514&amp;source=5\">Registration is now open</a> and available to all VMUG members. This is a great opportunity to meet with your peers to discuss virtualization trends, best practices, and the latest technology!<!--more-->\r\n\r\n11:00 a.m. - 2:00 p.m.\r\nNWN Corporation\r\n7025 Albert Pick Road, Suite 302\r\nGreensboro, NC 27409\r\n<a href=\"https://maps.google.com/maps?ie=UTF8&amp;cid=16783577983042985069&amp;q=NWN+Corporation&amp;iwloc=A&amp;gl=US&amp;hl=en\">Click here for directions</a>\r\n\r\nMeeting Agenda\r\n<ul>\r\n	<li>11:00 a.m. Registration and Member Mixer</li>\r\n	<li>11:15 a.m. Announcements, Agenda and Introductions</li>\r\n	<li>11:30 a.m. Performance Management - Stop the Virtualization Blame Game ~ Bernie Watson, Xangati</li>\r\n	<li>12:40 p.m. What is Better than a Great vSphere Application or Utility, a Free One ~ John Flisher, eGroup</li>\r\n	<li>1:45 p.m. Meeting Wrap-Up and Giveaways</li>\r\n</ul>\r\nVisit the <a href=\"http://www.vmug.com/e/in/eid=514&amp;source=5\">Event Details Page</a> for the full agenda. Be sure to share this meeting information with your colleagues.\r\n\r\nBe sure to visit the <a href=\"http://www.vmug.com/index.php?mo=cm&amp;op=ld&amp;fid=217&amp;gid=97&amp;source=5\">North Carolina Triad VMUG Workspace</a> and subscribe to the listserv! Connect with your fellow VMUG members in the forum, ask and answer questions about VMware, and get involved in your VMUG community.\r\n\r\nPlease note: You will need to log into the VMUG web site to register for this meeting. If you have not already obtained your VMUG login credentials, please visit the <a href=\"http://www.myvmug.org/l/li/if?source=5\">Username and/or Password Help</a> page to request your username and password.\r\n\r\n<a href=\"http://www.vmug.com/e/in/eid=514&amp;source=5\">CLICH HERE TO REGISTER!</a>\r\n\r\nFor questions, please contact <a href=\"mailto:memberservices@vmug.com\">memberservices@vmug.com</a>.\r\n\r\n&nbsp;','REGISTRATION NOW OPEN: NORTH CAROLINA TRIAD VMUG MEETING','','publish','open','open','','registration-now-open-north-carolina-triad-vmug-meeting','','','2012-07-05 14:03:34','2012-07-05 14:03:34','',0,'http://egroup.jasonmangone.com/?p=7004',0,'post','',0),(6913,35,'2012-06-25 05:35:52','2012-06-25 05:35:52','VMware released the <a href=\"http://communities.vmware.com/docs/DOC-19605\">vSphere 5.0 Hardening Guide</a> this month and I wanted to take the opportunity to blog my way through it in order to increase my familiarity, heighten its visibility, and provide a forum for discussion of the recommendations and methods to implement an assessment in your own environment.\r\n\r\nSince the hypervisor is the heart of your datacenter, let\'s start with the ESXi guidelines:\r\n<ul>\r\n	<li>Guideline Title: Use Active Directory for local user authentication\r\n<ul>\r\n	<li>Title: enable-ad-auth</li>\r\n	<li>Discussion: The credentials to your ESXi hosts are among the most sensitive in your entire datacenter. The root password should only be given to personnel that have an explicit need for it. Other users that need to login to hosts outside of vCenter can have permissions granted to their Active Directory account. David Davis has a <a href=\"http://blogs.vmware.com/esxi/2011/01/esxi-41-active-directory-integration.html\">great video</a> demonstrating the process. By default, an AD group names \"ESX Admins\" is checked for and all members will have full rights to all hosts.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc_50%2FGUID-25A5EB3B-7BB1-4B0B-9323-926AE6F0667F.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Establish a password policy for password complexity\r\n<ul>\r\n	<li>Title: set-password-complexity</li>\r\n	<li>Discussion: This setting is used to enforce strong passwords for local accounts. You know, the local accounts you\'re not using since all your hosts are joined to AD, right? But seriously, this is a great setting to use to force users to pick strong passwords, even if your hosts have no local users. Configuration drift happens, so let\'s plan ahead and make sure these users will have strong passwords. Using vi, you\'ll edit the file /etc/pam.d/passwd and modify the third line. The default value is \"password requisite /lib/security/$ISA/pam_passwdqc.so retry=3 min=8,8,8,7,6\". The retry value controls how many attempts users get to pick a strong password. The last 5 numbers control your desired complexity settings, in the following order and referencing four character classes (uppercase letters, lowercase letters, numbers, and symbols/special characters):\r\n<ul>\r\n	<li>The first digit is the minimum length for passwords containing characters from 1 of the classes (least complex, e.g. using \"password\" as your password). You\'ll want this to be a very large number.</li>\r\n	<li>The second digit is the minimum length for password containing characters from 2 of the classes. You\'ll also want this to be a very large number.</li>\r\n	<li>The third digit is the minimum length of SSL certificate passphrases</li>\r\n	<li>The fourth digit is the minimum length for password containing characters from 3 of the classes. Now were getting into reasonable passwords, so allow whatever reasonable length your organization permits.</li>\r\n	<li>The fifth digit is the minimum length for password containing characters from 4 of the classes (most complex, e.g. using \"p4$wOrd\" as your password\"). Same as the previous line.</li>\r\n</ul>\r\n</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc_50%2FGUID-942E8E23-D2CE-49B0-8B39-F31EF6D0519B.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Verify Active Directory \"ESX Admin\" group membership.\r\n<ul>\r\n	<li>Title: verify-admin-group</li>\r\n	<li>Discussion: now that our hosts are joined to AD (first bullet point above), we want to audit the membership of \"ESX Admins\" since those users will automatically have root-level permissions to our hosts. This is a manual check, but you\'ll also want to automate it so that it can run regularly. You can write a scheduled Powershell script to read the group membership and email you the contents on a schedule, or products like ADAudit Plus from ManageEngine are perfect for this task and can email you only when group membership changes.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/1025569\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Ensure that vpxuser auto-password change meets policy.\r\n<ul>\r\n	<li>Title: vpxuser-password-age</li>\r\n	<li>Discussion: ESXi contains a built-in user account called vpxuser. This account has Administrator-level permissions to the local host and is used by vCenter to execute tasks. vCenter sets this password and changes it automatically every 30 days. If your organization requires more frequent password changes, you can change this from the vSphere client by selecting \"Administration -&gt; vCenter Server Settings -&gt; Advanced Settings\" and changing VirtualCenter.VimPasswordExpirationInDays to your desired interval.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc_50%2FGUID-20FA4157-F371-4922-92E8-63822FA808FA.html\">Official VMware Documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li> Guideline Title: Ensure that vpxuser password meets length policy.\r\n<ul>\r\n	<li>Title:vpxuser-password-length</li>\r\n	<li>Discussion: Similar to the guideline above, this check confirms that the password length for the vpxuser password is long enough to comply with your organization\'s security policy. By default it is set to 32 characters. To increase this password length, modify the \"vpxd.hostPasswordLength\" value in the vpxd.cfg file. On Windows this file is located at C:\\Documents and Settings\\All Users\\Application Data\\VMware\\VMware VirtualCenter\\vpxd.cfg  or on the vCenter Server Appliance you\'ll find it at /etc/vmware-vpx/vpxd.cfg.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc_50%2FGUID-20FA4157-F371-4922-92E8-63822FA808FA.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>\r\nThat\'s it for today! I\'ll see you all back here tomorrow to continue our discussion on the vSphere 5.0 Hardening Guide.','VSPHERE 5.0 HARDENING GUIDE DISCUSSION - PART 1','','inherit','open','open','','6904-revision-7','','','2012-06-25 05:35:52','2012-06-25 05:35:52','',6904,'http://egroup.jasonmangone.com/6904-revision-7',0,'revision','',0),(6914,35,'2012-06-26 08:00:32','2012-06-26 08:00:32','Welcome back to part 2 of our discussion of the vSphere 5.0 Hardening Guide! If you missed part 1, you can find it <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">here</a>. Let\'s get back to it!\r\n<ul>\r\n	<li>Guideline Title: Communication Configure the ESXi host firewall to restrict access to services running on the host\r\n<ul>\r\n	<li>Title: config-firewall-access</li>\r\n	<li>Discussion: The process of hardening a production server involves stopping unnecessary services and protecting services that need to remain running, and ESXi is no different. Unnecessary services should be disabled. Necessary services can be protected by defining allowed IPs that are allowed to connect. These IPs can be set under \"Configuration -&gt; Security Profile -&gt; Firewall -&gt; Properties\". Select a service then click \"Firewall\", choose \"Only allow connections from the following networks\" and specify the IPs or ranges that will be allowed to connect.\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png\"><img class=\"alignnone  wp-image-6923\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png\" alt=\"\" width=\"374\" height=\"236\" /></a></li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-DD4322FF-3DC4-4716-8819-6688938F99D7.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Configure NTP time synchronization\r\n<ul>\r\n	<li>Title: config-ntp</li>\r\n	<li>Discussion: NTP serves two purposes. First,  in the event of a security breach, having your ESXi system logs synchronized will lend itself to an effective incident postmortem, which can, in turn, help increase the security of your environment and further remediate vulnerabilities. Second,  NTP will be used by any VMs that utilize the VMware Tools time synchronization. When the host has accurate time, the VMs using it as a time source will also. I prefer to pick a single device inside the firewall (possibly the firewall itself) to serve as my internal NTP source. Then I have all my other hosts sync against that device. This means that if the internet connection goes down, only one system notices and the rest of the systems all stay in sync with each other, though not necessarily with the rest of the world. So set an NTP server choose \"Configuration -&gt; Time Configuration -&gt; Options -&gt; start the NTP service and select \"Start and stop with host\"\". Click \'Add\' and specify your site\'s NTP servers.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_networks.11.8.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Ensure proper SNMP configuration\r\n<ul>\r\n	<li>Title: config-snmp</li>\r\n	<li>Discussion: SNMP is a protocol for monitoring network resources (hosts, servers, switches, etc). If your environment is not using SNMP, it should be disabled to avoid disclosing ESXi host status information to malicious observers. (Of course, if you\'re following along, you\'ve already locked down which IPs and ranges can reach the SNMP agent!) The ESXi SNMP agent is disabled by default. To confirm this, run \"vicfg-snmp &lt;conn_options&gt; --show\", or to disable it in environments where it is not used, run \"vicfg-snmp &lt;conn_options&gt; --disable\". If SNMP is being used, make sure the parameters are properly configured using either vCLI or PowerCLI, or using an API client.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.monitoring.doc_50/GUID-8EF36D7D-59B6-4C74-B1AA-4A9D18AB6250.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Disable Managed Object Browser (MOB)\r\n<ul>\r\n	<li>Title: disable-mob</li>\r\n	<li>Discussion: I can\'t put it any better than the VMware-provided description for this vulnerability already has. I\'ll quote it below directly from the Hardening Guidelines.\r\n<ul>\r\n	<li>\"The managed object browser (MOB) provides a way to explore the object model used by the VMkernel to manage the host; it enables configurations to be changed as well. This interface is meant to be used primarily for debugging the vSphere SDK but because there are no access controls it could also be used as a method obtain information about a host being targeted for unauthorized access. To determine if the MOB is enabled run the following command on the ESXi shell: \"vim-cmd proxysvc/service_list\". To disable the MOB run the following command: \"vim-cmd proxysvc/remove_service \"/mob\" \"httpsWithRedirect\"\". Note: You cannot disable MOB while in lockdown mode. The MOB will no longer be available for diagnostics. Some 3rd party tools use this interface to gather information. Testing should be done after disabling the MOB to verify 3rd party applications are still functioning as expected. To re-enable the MOB: ~ # vim-cmd proxysvc/add_np_service \"/mob\" httpsWithRedirect\"</li>\r\n</ul>\r\n</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/1016039\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: When adding ESXi hosts to Active Directory use the vSphere Authentication Proxy to protect passwords\r\n<ul>\r\n	<li>Title: enable-auth-proxy</li>\r\n	<li>Discussion: In environments that use both ESXi Autodeploy and Active Directory to manage hosts, the password used to join Active Directory is sent in cleartext to each host as it boots up, which puts that password at great risk of interception. Instead, VMware provides a vSphere Authentication Proxy to help keep this communication secure. Here are the <a href=\"http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.install.doc_50%2FGUID-EA920335-2608-4127-9B57-DB3809BA4BB9.html\">official deployment instructions</a>.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-084B74BD-40A5-4A4B-A82C-0C9912D580DC.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>\r\nWe\'ll pick this back up tomorrow and knock out another 5 ESXi hardening checks!','VSPHERE 5.0 HARDENING GUIDE DISCUSSION - PART 2','','publish','open','open','','vsphere-5-0-hardening-guide-discussion-part-2','','','2012-06-26 04:15:02','2012-06-26 04:15:02','',0,'http://egroup.jasonmangone.com/?p=6914',0,'post','',0),(7038,23,'2012-07-18 11:30:24','2012-07-18 15:30:24','If you downloaded the SharePoint 2013 Customer Preview and tried to install as a Standalone deployment, you are probably having issues.  Here\'s the error we\'re seeing...\r\n\r\nErrorCode:SubStatus: Service running under Network Service account in workgroup environment is not supported.\r\n\r\nThis is caused by AppFabric\'s Distributed Caching and can be avoided by running the PSCONFIG utility with a specific switch.  Here\'s how to do it...\r\n<ul>\r\n	<li>Open PowerShell as Administrator</li>\r\n	<li>Type the following to change the directory...\r\ncd \'C:\\Program Files\\Common Files\\microsoft shared\\Web Server Extensions\\15\\BIN\'</li>\r\n	<li> Type the following to setup your farm...\r\n.\\PSCONFIG.EXE -cmd Configdb create SkipRegisterAsDistributedCacheHost</li>\r\n	<li>Additionally, you will need to download and install the SQL 2008R2 or 2012 Management Studio Tools.  Once downloaded, install and open, then do the following...</li>\r\n	<li>Connect to the local .\\SHAREPOINT instance</li>\r\n	<li>Expand Security &gt; Logins and go to the properties for the user you are using to install SharePoint</li>\r\n	<li>Go to Server Roles and make sure the following are checked...\r\n<ul>\r\n	<li>setupadmin</li>\r\n	<li>sysadmin</li>\r\n	<li>serveradmin</li>\r\n	<li>dbcreator</li>\r\n</ul>\r\n</li>\r\n	<li>Click OK and retry running the Configuration Wizard.</li>\r\n</ul>\r\nYou may still this error...\r\n\r\n<em>The SDDL string contains an invalid sid or a sid that cannot be translated. Parameter name: sddlForm</em>\r\n\r\nHowever, Central Administration still works.  Load it up and check it out!','SHAREPOINT 2013: STANDALONE INSTALL ISSUES','','publish','open','open','','sharepoint-2013-standalone-install-issues','','','2012-07-18 15:43:08','2012-07-18 19:43:08','',0,'http://egroup.jasonmangone.com/?p=7038',0,'post','',0),(6916,24,'2012-06-26 02:23:22','2012-06-26 02:23:22','I am back again after just passing the final CCNP exam, the TSHOOT exam 642-832.  This one was a bit different since most of it was simulations.  I only had three questions that were the typical multiple choice.  The rest were simulation questions.  You could look at any of the devices and use show commands, but you cannot make any changes.  You have to identify on what device the problem is located on, then you have to say what category the issue is in (DHCP, BGP, EIGRP, etc), and then choose what you would do to fix it.  This is a test where you have to know what you are doing and what commands do what.  There really isn\'t a good way of studying other practicing on Cisco devices and troubleshooting in either the lab or the real world.  Here is what I used though.\r\n\r\nFirst off, again I used CBT Nuggets.  Here is the link:\r\n\r\nhttp://www.cbtnuggets.com/it-training-videos/series/cisco-ccnp-tshoot-642-832\r\n\r\nAgain it is definitely on the pricey side, but Jeremy went through a bunch of different sims and showed how he goes about troubleshooting issues and what commands you would use to fix them.  Very helpful.\r\n\r\n\r\nAfter watching the videos I then read the Cisco Press 642-832 Official Certification guide.  \r\n\r\nhttp://www.amazon.com/TSHOOT-642-832-Official-Certification-Guide/dp/1587058448/ref=sr_1_1?ie=UTF8&amp;qid=1340677230&amp;sr=8-1&amp;keywords=642-832\r\n\r\nThis was helpful in that it went into a bit more detail in some areas then Jeremy did.  Without Jeremy going through the labs first though it would not have been as easy to understand everything the first read through.\r\n\r\nThe rest of it was practicing using GNS3 and troubleshooting issues in the real world.\r\n\r\nHope this helps and good luck!','Passing the TSHOOT 642-832 EXAM','','publish','open','open','','passing-the-tshoot-642-832-exam','','','2012-06-26 02:23:22','2012-06-26 02:23:22','',0,'http://egroup.jasonmangone.com/?p=6916',0,'post','',0),(6917,24,'2012-06-26 02:23:06','2012-06-26 02:23:06','I am back again after just passing the final CCNP exam, the TSHOOT exam 642-832.  This one was a bit different since most of it was simulations.  I only had three questions that were the typical multiple choice.  The rest were simulation questions.  You could look at any of the devices and use show commands, but you cannot make any changes.  You have to identify on what device the problem is located on, then you have to say what category the issue is in (DHCP, BGP, EIGRP, etc), and then choose what you would do to fix it.  This is a test where you have to know what you are doing and what commands do what.  There really isn\'t a good way of studying other practicing on Cisco devices and troubleshooting in either the lab or the real world.  Here is what I used though.\n\nFirst off, again I used CBT Nuggets.  Here is the link:\n\nhttp://www.cbtnuggets.com/it-training-videos/series/cisco-ccnp-tshoot-642-832\n\nAgain it is definitely on the pricey side, but Jeremy went through a bunch of different sims and showed how he goes about troubleshooting issues and what commands you would use to fix them.  Very helpful.\n\n\nAfter watching the videos I then read the Cisco Press 642-832 Official Certification guide.  \n\nhttp://www.amazon.com/TSHOOT-642-832-Official-Certification-Guide/dp/1587058448/ref=sr_1_1?ie=UTF8&amp;qid=1340677230&amp;sr=8-1&amp;keywords=642-832\n\nThis was helpful in that it went into a bit more detail in some areas then Jeremy did.  Without Jeremy going through the labs first though it would not have been as easy to understand everything the first read through.\n\nThe rest of it was practicing using GNS3 and troubleshooting issues in the real world.\n\nHope this helps and good luck!','','','inherit','open','open','','6916-revision','','','2012-06-26 02:23:06','2012-06-26 02:23:06','',6916,'http://egroup.jasonmangone.com/6916-revision',0,'revision','',0),(6919,35,'2012-06-26 02:54:24','2012-06-26 02:54:24','Welcome back to part 2 of our discussion of the vSphere 5.0 Hardening Guide! If you missed part 1, you can find it <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">here</a>. Let\'s get back to it!\n<ul>\n	<li>Guideline Title: Communication Configure the ESXi host firewall to restrict access to services running on the host\n<ul>\n	<li>Title: config-firewall-access</li>\n	<li>Discussion: The process of hardening a production server involves stopping unnecessary services and protecting services that need to remain running, and ESXi is no different. Unnecessary services should be disabled. Necessary services can be protected at the From the vSphere client, select each host and go to \"Configuration -&gt; Security Profile\". In the \"Firewall\" section select \"Properties\". For each enabled service, (e.g. ssh, vSphere Web Access, http client), select \"Firewall\", select \"Only allow connections from the following networks\" and provide a range of authorized IP addresses.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-DD4322FF-3DC4-4716-8819-6688938F99D7.html\">Official VMware Documentation</a></li>\n</ul>\n</li>\n	<li>config-ntp vSphere 5.0 ESXI Communication Configure NTP time synchronization By ensuring that all systems use the same relative time source (including the relevant localization offset), and that the relative time source can be correlated to an agreed-upon time standard (such as Coordinated Universal Time—UTC), you can make it simpler to track and correlate an intruder’s actions when reviewing the relevant log files. Incorrect time settings can make it difficult to inspect and correlate log files to detect attacks, and can make auditing inaccurate. 1,2,3 Parameter From the vSphere Client: Select the host and click \"Configuration -&gt; Time Configuration\". Select the properties link and chose \'Options\'. From the General tab start the NTP service and select \"Start and stop with host\". From the NTP Settings tab click the \' Add\' button to add the site specific NTP servers. NTP can also be configured using the vCLI or PowerCLI. It is recommended to synchronize the ESXi clock with a time server that is located on the management network rather than directly with a time server on a public network. This time server can then synchronize with a public source through a strictly controlled network connection with a firewall. Note: Verify the required firewall ports are open. /etc/ntp.conf N/A Site Specific Modify No http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_networks.11.8.html</li>\n	<li>config-snmp vSphere 5.0 ESXI Communication Ensure proper SNMP configuration If SNMP is not being used, it should remain disabled. If it is being used, the proper trap destination should be configured. If SNMP is not properly configured, monitoring information can be sent to a malicious host that can then use this information to plan an attack. 1,2,3 Parameter Run \"vicfg-snmp &lt;conn_options&gt; --show\" to determine if SNMP is being used. If SNMP is not being used, make sure that it is not running: \"vicfg-snmp &lt;conn_options&gt; --disable&gt;. If SNMP is being used, refer to the vSphere Command-Line Interface Concepts and Examples guide, Chapter 10 for steps to make sure the parameters are properly configured. SNMP must be configured on each ESXi host using either vCLI or PowerCLI, or using an API client. /etc/vmware/snmp.xml N/A site-specific Modify N/A http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.monitoring.doc_50/GUID-8EF36D7D-59B6-4C74-B1AA-4A9D18AB6250.html</li>\n	<li>disable-mob vSphere 5.0 ESXI Communication Disable Managed Object Browser (MOB) The managed object browser (MOB) provides a way to explore the object model used by the VMkernel to manage the host; it enables configurations to be changed as well. This interface is meant to be used primarily for debugging the vSphere SDK but because there are no access controls it could also be used as a method obtain information about a host being targeted for unauthorized access. 1,2,3 Parameter To determine if the MOB is enabled run the following command on the ESXi shell: ~# vim-cmd proxysvc/service_list. To disable the MOB run the following command: ~# vim-cmd proxysvc/remove_service \"/mob\" \"httpsWithRedirect\". Note: You cannot disable MOB while in lockdown mode. N/A N/A Remove Service Remove No The MOB will no longer be available for diagnostics. Some 3rd party tools use this interface to gather information. Testing should be done after disabling the MOB to verify 3rd party applications are still functioning as expected. To re-enable the MOB: ~ # vim-cmd proxysvc/add_np_service \"/mob\" httpsWithRedirect /var/run/vmware/proxy-mob http://kb.vmware.com/kb/1016039</li>\n	<li>enable-auth-proxy vSphere 5.0 ESXI Communication When adding ESXi hosts to Active Directory use the vSphere Authentication Proxy to protect passwords If you configure your host to join an Active Directory domain using host profiles, the passwords used to authenticate the host are not protected. To avoid transmitting clear text passwords use the vSphere Authentication Proxy to configure hosts in Active Directory. 1,2,3 Parameter From the vSphere client home page select \"Host Profiles\". Right click the Host Profile and select Edit. Choose \"Authentication configuration -&gt; Active Directory Configuration -&gt; Join Domain Method\". Set the Join Domain Method to \"Use vSphere Authentication Proxy to add the host to domain\". N/A N/A Site Specific Modify No http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-084B74BD-40A5-4A4B-A82C-0C9912D580DC.html</li>\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION - PART 2','','inherit','open','open','','6914-revision','','','2012-06-26 02:54:24','2012-06-26 02:54:24','',6914,'http://egroup.jasonmangone.com/6914-revision',0,'revision','',0),(6918,35,'2012-06-26 02:57:30','2012-06-26 02:57:30','','esxi5firewall','','inherit','open','open','','esxi5firewall','','','2012-06-26 02:57:30','2012-06-26 02:57:30','',6914,'http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall.png',0,'attachment','image/png',0),(6920,35,'2012-06-26 02:57:55','2012-06-26 02:57:55','Welcome back to part 2 of our discussion of the vSphere 5.0 Hardening Guide! If you missed part 1, you can find it <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">here</a>. Let\'s get back to it!\r\n<ul>\r\n	<li>Guideline Title: Communication Configure the ESXi host firewall to restrict access to services running on the host\r\n<ul>\r\n	<li>Title: config-firewall-access</li>\r\n	<li>Discussion: The process of hardening a production server involves stopping unnecessary services and protecting services that need to remain running, and ESXi is no different. Unnecessary services should be disabled. Necessary services can be protected at the From the vSphere client, select each host and go to \"Configuration -&gt; Security Profile\". In the \"Firewall\" section select \"Properties\". For each enabled service, (e.g. ssh, vSphere Web Access, http client), select \"Firewall\", select \"Only allow connections from the following networks\" and provide a range of authorized IP addresses.<img class=\"alignnone size-medium wp-image-6918\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall-300x189.png\" alt=\"\" width=\"300\" height=\"189\" /></li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-DD4322FF-3DC4-4716-8819-6688938F99D7.html\">Official VMware Documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>config-ntp vSphere 5.0 ESXI Communication Configure NTP time synchronization By ensuring that all systems use the same relative time source (including the relevant localization offset), and that the relative time source can be correlated to an agreed-upon time standard (such as Coordinated Universal Time—UTC), you can make it simpler to track and correlate an intruder’s actions when reviewing the relevant log files. Incorrect time settings can make it difficult to inspect and correlate log files to detect attacks, and can make auditing inaccurate. 1,2,3 Parameter From the vSphere Client: Select the host and click \"Configuration -&gt; Time Configuration\". Select the properties link and chose \'Options\'. From the General tab start the NTP service and select \"Start and stop with host\". From the NTP Settings tab click the \' Add\' button to add the site specific NTP servers. NTP can also be configured using the vCLI or PowerCLI. It is recommended to synchronize the ESXi clock with a time server that is located on the management network rather than directly with a time server on a public network. This time server can then synchronize with a public source through a strictly controlled network connection with a firewall. Note: Verify the required firewall ports are open. /etc/ntp.conf N/A Site Specific Modify No http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_networks.11.8.html</li>\r\n	<li>config-snmp vSphere 5.0 ESXI Communication Ensure proper SNMP configuration If SNMP is not being used, it should remain disabled. If it is being used, the proper trap destination should be configured. If SNMP is not properly configured, monitoring information can be sent to a malicious host that can then use this information to plan an attack. 1,2,3 Parameter Run \"vicfg-snmp &lt;conn_options&gt; --show\" to determine if SNMP is being used. If SNMP is not being used, make sure that it is not running: \"vicfg-snmp &lt;conn_options&gt; --disable&gt;. If SNMP is being used, refer to the vSphere Command-Line Interface Concepts and Examples guide, Chapter 10 for steps to make sure the parameters are properly configured. SNMP must be configured on each ESXi host using either vCLI or PowerCLI, or using an API client. /etc/vmware/snmp.xml N/A site-specific Modify N/A http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.monitoring.doc_50/GUID-8EF36D7D-59B6-4C74-B1AA-4A9D18AB6250.html</li>\r\n	<li>disable-mob vSphere 5.0 ESXI Communication Disable Managed Object Browser (MOB) The managed object browser (MOB) provides a way to explore the object model used by the VMkernel to manage the host; it enables configurations to be changed as well. This interface is meant to be used primarily for debugging the vSphere SDK but because there are no access controls it could also be used as a method obtain information about a host being targeted for unauthorized access. 1,2,3 Parameter To determine if the MOB is enabled run the following command on the ESXi shell: ~# vim-cmd proxysvc/service_list. To disable the MOB run the following command: ~# vim-cmd proxysvc/remove_service \"/mob\" \"httpsWithRedirect\". Note: You cannot disable MOB while in lockdown mode. N/A N/A Remove Service Remove No The MOB will no longer be available for diagnostics. Some 3rd party tools use this interface to gather information. Testing should be done after disabling the MOB to verify 3rd party applications are still functioning as expected. To re-enable the MOB: ~ # vim-cmd proxysvc/add_np_service \"/mob\" httpsWithRedirect /var/run/vmware/proxy-mob http://kb.vmware.com/kb/1016039</li>\r\n	<li>enable-auth-proxy vSphere 5.0 ESXI Communication When adding ESXi hosts to Active Directory use the vSphere Authentication Proxy to protect passwords If you configure your host to join an Active Directory domain using host profiles, the passwords used to authenticate the host are not protected. To avoid transmitting clear text passwords use the vSphere Authentication Proxy to configure hosts in Active Directory. 1,2,3 Parameter From the vSphere client home page select \"Host Profiles\". Right click the Host Profile and select Edit. Choose \"Authentication configuration -&gt; Active Directory Configuration -&gt; Join Domain Method\". Set the Join Domain Method to \"Use vSphere Authentication Proxy to add the host to domain\". N/A N/A Site Specific Modify No http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-084B74BD-40A5-4A4B-A82C-0C9912D580DC.html</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION - PART 2','','inherit','open','open','','6914-revision-2','','','2012-06-26 02:57:55','2012-06-26 02:57:55','',6914,'http://egroup.jasonmangone.com/6914-revision-2',0,'revision','',0),(6921,35,'2012-06-26 02:58:02','2012-06-26 02:58:02','Welcome back to part 2 of our discussion of the vSphere 5.0 Hardening Guide! If you missed part 1, you can find it <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">here</a>. Let\'s get back to it!\r\n<ul>\r\n	<li>Guideline Title: Communication Configure the ESXi host firewall to restrict access to services running on the host\r\n<ul>\r\n	<li>Title: config-firewall-access</li>\r\n	<li>Discussion: The process of hardening a production server involves stopping unnecessary services and protecting services that need to remain running, and ESXi is no different. Unnecessary services should be disabled. Necessary services can be protected at the From the vSphere client, select each host and go to \"Configuration -&gt; Security Profile\". In the \"Firewall\" section select \"Properties\". For each enabled service, (e.g. ssh, vSphere Web Access, http client), select \"Firewall\", select \"Only allow connections from the following networks\" and provide a range of authorized IP addresses.<img class=\"alignnone size-medium wp-image-6918\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall-300x189.png\" alt=\"\" width=\"300\" height=\"189\" /></li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-DD4322FF-3DC4-4716-8819-6688938F99D7.html\">Official VMware Documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>config-ntp vSphere 5.0 ESXI Communication Configure NTP time synchronization By ensuring that all systems use the same relative time source (including the relevant localization offset), and that the relative time source can be correlated to an agreed-upon time standard (such as Coordinated Universal Time—UTC), you can make it simpler to track and correlate an intruder’s actions when reviewing the relevant log files. Incorrect time settings can make it difficult to inspect and correlate log files to detect attacks, and can make auditing inaccurate. 1,2,3 Parameter From the vSphere Client: Select the host and click \"Configuration -&gt; Time Configuration\". Select the properties link and chose \'Options\'. From the General tab start the NTP service and select \"Start and stop with host\". From the NTP Settings tab click the \' Add\' button to add the site specific NTP servers. NTP can also be configured using the vCLI or PowerCLI. It is recommended to synchronize the ESXi clock with a time server that is located on the management network rather than directly with a time server on a public network. This time server can then synchronize with a public source through a strictly controlled network connection with a firewall. Note: Verify the required firewall ports are open. /etc/ntp.conf N/A Site Specific Modify No http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_networks.11.8.html</li>\r\n	<li>config-snmp vSphere 5.0 ESXI Communication Ensure proper SNMP configuration If SNMP is not being used, it should remain disabled. If it is being used, the proper trap destination should be configured. If SNMP is not properly configured, monitoring information can be sent to a malicious host that can then use this information to plan an attack. 1,2,3 Parameter Run \"vicfg-snmp &lt;conn_options&gt; --show\" to determine if SNMP is being used. If SNMP is not being used, make sure that it is not running: \"vicfg-snmp &lt;conn_options&gt; --disable&gt;. If SNMP is being used, refer to the vSphere Command-Line Interface Concepts and Examples guide, Chapter 10 for steps to make sure the parameters are properly configured. SNMP must be configured on each ESXi host using either vCLI or PowerCLI, or using an API client. /etc/vmware/snmp.xml N/A site-specific Modify N/A http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.monitoring.doc_50/GUID-8EF36D7D-59B6-4C74-B1AA-4A9D18AB6250.html</li>\r\n	<li>disable-mob vSphere 5.0 ESXI Communication Disable Managed Object Browser (MOB) The managed object browser (MOB) provides a way to explore the object model used by the VMkernel to manage the host; it enables configurations to be changed as well. This interface is meant to be used primarily for debugging the vSphere SDK but because there are no access controls it could also be used as a method obtain information about a host being targeted for unauthorized access. 1,2,3 Parameter To determine if the MOB is enabled run the following command on the ESXi shell: ~# vim-cmd proxysvc/service_list. To disable the MOB run the following command: ~# vim-cmd proxysvc/remove_service \"/mob\" \"httpsWithRedirect\". Note: You cannot disable MOB while in lockdown mode. N/A N/A Remove Service Remove No The MOB will no longer be available for diagnostics. Some 3rd party tools use this interface to gather information. Testing should be done after disabling the MOB to verify 3rd party applications are still functioning as expected. To re-enable the MOB: ~ # vim-cmd proxysvc/add_np_service \"/mob\" httpsWithRedirect /var/run/vmware/proxy-mob http://kb.vmware.com/kb/1016039</li>\r\n	<li>enable-auth-proxy vSphere 5.0 ESXI Communication When adding ESXi hosts to Active Directory use the vSphere Authentication Proxy to protect passwords If you configure your host to join an Active Directory domain using host profiles, the passwords used to authenticate the host are not protected. To avoid transmitting clear text passwords use the vSphere Authentication Proxy to configure hosts in Active Directory. 1,2,3 Parameter From the vSphere client home page select \"Host Profiles\". Right click the Host Profile and select Edit. Choose \"Authentication configuration -&gt; Active Directory Configuration -&gt; Join Domain Method\". Set the Join Domain Method to \"Use vSphere Authentication Proxy to add the host to domain\". N/A N/A Site Specific Modify No http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-084B74BD-40A5-4A4B-A82C-0C9912D580DC.html</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION - PART 2','','inherit','open','open','','6914-revision-3','','','2012-06-26 02:58:02','2012-06-26 02:58:02','',6914,'http://egroup.jasonmangone.com/6914-revision-3',0,'revision','',0),(6922,35,'2012-06-26 03:00:16','2012-06-26 03:00:16','Welcome back to part 2 of our discussion of the vSphere 5.0 Hardening Guide! If you missed part 1, you can find it <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">here</a>. Let\'s get back to it!\r\n<ul>\r\n	<li>Guideline Title: Communication Configure the ESXi host firewall to restrict access to services running on the host\r\n<ul>\r\n	<li>Title: config-firewall-access</li>\r\n	<li>Discussion: The process of hardening a production server involves stopping unnecessary services and protecting services that need to remain running, and ESXi is no different. Unnecessary services should be disabled. Necessary services can be protected by defining allowed IPs that are allowed to connect. These IPs can be set under \"Configuration -&gt; Security Profile -&gt; Firewall -&gt; Properties\". Select a service then click \"Firewall\", choose \"Only allow connections from the following networks\" and specify the IPs or ranges that will be allowed to connect.\r\n<img class=\"alignnone size-medium wp-image-6918\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall-300x189.png\" alt=\"\" width=\"300\" height=\"189\" /></li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-DD4322FF-3DC4-4716-8819-6688938F99D7.html\">Official VMware Documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>config-ntp vSphere 5.0 ESXI Communication Configure NTP time synchronization By ensuring that all systems use the same relative time source (including the relevant localization offset), and that the relative time source can be correlated to an agreed-upon time standard (such as Coordinated Universal Time—UTC), you can make it simpler to track and correlate an intruder’s actions when reviewing the relevant log files. Incorrect time settings can make it difficult to inspect and correlate log files to detect attacks, and can make auditing inaccurate. 1,2,3 Parameter From the vSphere Client: Select the host and click \"Configuration -&gt; Time Configuration\". Select the properties link and chose \'Options\'. From the General tab start the NTP service and select \"Start and stop with host\". From the NTP Settings tab click the \' Add\' button to add the site specific NTP servers. NTP can also be configured using the vCLI or PowerCLI. It is recommended to synchronize the ESXi clock with a time server that is located on the management network rather than directly with a time server on a public network. This time server can then synchronize with a public source through a strictly controlled network connection with a firewall. Note: Verify the required firewall ports are open. /etc/ntp.conf N/A Site Specific Modify No http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_networks.11.8.html</li>\r\n	<li>config-snmp vSphere 5.0 ESXI Communication Ensure proper SNMP configuration If SNMP is not being used, it should remain disabled. If it is being used, the proper trap destination should be configured. If SNMP is not properly configured, monitoring information can be sent to a malicious host that can then use this information to plan an attack. 1,2,3 Parameter Run \"vicfg-snmp &lt;conn_options&gt; --show\" to determine if SNMP is being used. If SNMP is not being used, make sure that it is not running: \"vicfg-snmp &lt;conn_options&gt; --disable&gt;. If SNMP is being used, refer to the vSphere Command-Line Interface Concepts and Examples guide, Chapter 10 for steps to make sure the parameters are properly configured. SNMP must be configured on each ESXi host using either vCLI or PowerCLI, or using an API client. /etc/vmware/snmp.xml N/A site-specific Modify N/A http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.monitoring.doc_50/GUID-8EF36D7D-59B6-4C74-B1AA-4A9D18AB6250.html</li>\r\n	<li>disable-mob vSphere 5.0 ESXI Communication Disable Managed Object Browser (MOB) The managed object browser (MOB) provides a way to explore the object model used by the VMkernel to manage the host; it enables configurations to be changed as well. This interface is meant to be used primarily for debugging the vSphere SDK but because there are no access controls it could also be used as a method obtain information about a host being targeted for unauthorized access. 1,2,3 Parameter To determine if the MOB is enabled run the following command on the ESXi shell: ~# vim-cmd proxysvc/service_list. To disable the MOB run the following command: ~# vim-cmd proxysvc/remove_service \"/mob\" \"httpsWithRedirect\". Note: You cannot disable MOB while in lockdown mode. N/A N/A Remove Service Remove No The MOB will no longer be available for diagnostics. Some 3rd party tools use this interface to gather information. Testing should be done after disabling the MOB to verify 3rd party applications are still functioning as expected. To re-enable the MOB: ~ # vim-cmd proxysvc/add_np_service \"/mob\" httpsWithRedirect /var/run/vmware/proxy-mob http://kb.vmware.com/kb/1016039</li>\r\n	<li>enable-auth-proxy vSphere 5.0 ESXI Communication When adding ESXi hosts to Active Directory use the vSphere Authentication Proxy to protect passwords If you configure your host to join an Active Directory domain using host profiles, the passwords used to authenticate the host are not protected. To avoid transmitting clear text passwords use the vSphere Authentication Proxy to configure hosts in Active Directory. 1,2,3 Parameter From the vSphere client home page select \"Host Profiles\". Right click the Host Profile and select Edit. Choose \"Authentication configuration -&gt; Active Directory Configuration -&gt; Join Domain Method\". Set the Join Domain Method to \"Use vSphere Authentication Proxy to add the host to domain\". N/A N/A Site Specific Modify No http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-084B74BD-40A5-4A4B-A82C-0C9912D580DC.html</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION - PART 2','','inherit','open','open','','6914-revision-4','','','2012-06-26 03:00:16','2012-06-26 03:00:16','',6914,'http://egroup.jasonmangone.com/6914-revision-4',0,'revision','',0),(6923,35,'2012-06-26 03:00:59','2012-06-26 03:00:59','','esxi5firewall','','inherit','open','open','','esxi5firewall-2','','','2012-06-26 03:00:59','2012-06-26 03:00:59','',6914,'http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png',0,'attachment','image/png',0),(6924,35,'2012-06-26 03:01:20','2012-06-26 03:01:20','Welcome back to part 2 of our discussion of the vSphere 5.0 Hardening Guide! If you missed part 1, you can find it <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">here</a>. Let\'s get back to it!\n<ul>\n	<li>Guideline Title: Communication Configure the ESXi host firewall to restrict access to services running on the host\n<ul>\n	<li>Title: config-firewall-access</li>\n	<li>Discussion: The process of hardening a production server involves stopping unnecessary services and protecting services that need to remain running, and ESXi is no different. Unnecessary services should be disabled. Necessary services can be protected by defining allowed IPs that are allowed to connect. These IPs can be set under \"Configuration -&gt; Security Profile -&gt; Firewall -&gt; Properties\". Select a service then click \"Firewall\", choose \"Only allow connections from the following networks\" and specify the IPs or ranges that will be allowed to connect.\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png\"><img class=\"alignnone size-full wp-image-6923\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png\" alt=\"\" width=\"623\" height=\"394\" /></a></li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-DD4322FF-3DC4-4716-8819-6688938F99D7.html\">Official VMware Documentation</a></li>\n</ul>\n</li>\n	<li>config-ntp vSphere 5.0 ESXI Communication Configure NTP time synchronization By ensuring that all systems use the same relative time source (including the relevant localization offset), and that the relative time source can be correlated to an agreed-upon time standard (such as Coordinated Universal Time—UTC), you can make it simpler to track and correlate an intruder’s actions when reviewing the relevant log files. Incorrect time settings can make it difficult to inspect and correlate log files to detect attacks, and can make auditing inaccurate. 1,2,3 Parameter From the vSphere Client: Select the host and click \"Configuration -&gt; Time Configuration\". Select the properties link and chose \'Options\'. From the General tab start the NTP service and select \"Start and stop with host\". From the NTP Settings tab click the \' Add\' button to add the site specific NTP servers. NTP can also be configured using the vCLI or PowerCLI. It is recommended to synchronize the ESXi clock with a time server that is located on the management network rather than directly with a time server on a public network. This time server can then synchronize with a public source through a strictly controlled network connection with a firewall. Note: Verify the required firewall ports are open. /etc/ntp.conf N/A Site Specific Modify No http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_networks.11.8.html</li>\n	<li>config-snmp vSphere 5.0 ESXI Communication Ensure proper SNMP configuration If SNMP is not being used, it should remain disabled. If it is being used, the proper trap destination should be configured. If SNMP is not properly configured, monitoring information can be sent to a malicious host that can then use this information to plan an attack. 1,2,3 Parameter Run \"vicfg-snmp &lt;conn_options&gt; --show\" to determine if SNMP is being used. If SNMP is not being used, make sure that it is not running: \"vicfg-snmp &lt;conn_options&gt; --disable&gt;. If SNMP is being used, refer to the vSphere Command-Line Interface Concepts and Examples guide, Chapter 10 for steps to make sure the parameters are properly configured. SNMP must be configured on each ESXi host using either vCLI or PowerCLI, or using an API client. /etc/vmware/snmp.xml N/A site-specific Modify N/A http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.monitoring.doc_50/GUID-8EF36D7D-59B6-4C74-B1AA-4A9D18AB6250.html</li>\n	<li>disable-mob vSphere 5.0 ESXI Communication Disable Managed Object Browser (MOB) The managed object browser (MOB) provides a way to explore the object model used by the VMkernel to manage the host; it enables configurations to be changed as well. This interface is meant to be used primarily for debugging the vSphere SDK but because there are no access controls it could also be used as a method obtain information about a host being targeted for unauthorized access. 1,2,3 Parameter To determine if the MOB is enabled run the following command on the ESXi shell: ~# vim-cmd proxysvc/service_list. To disable the MOB run the following command: ~# vim-cmd proxysvc/remove_service \"/mob\" \"httpsWithRedirect\". Note: You cannot disable MOB while in lockdown mode. N/A N/A Remove Service Remove No The MOB will no longer be available for diagnostics. Some 3rd party tools use this interface to gather information. Testing should be done after disabling the MOB to verify 3rd party applications are still functioning as expected. To re-enable the MOB: ~ # vim-cmd proxysvc/add_np_service \"/mob\" httpsWithRedirect /var/run/vmware/proxy-mob http://kb.vmware.com/kb/1016039</li>\n	<li>enable-auth-proxy vSphere 5.0 ESXI Communication When adding ESXi hosts to Active Directory use the vSphere Authentication Proxy to protect passwords If you configure your host to join an Active Directory domain using host profiles, the passwords used to authenticate the host are not protected. To avoid transmitting clear text passwords use the vSphere Authentication Proxy to configure hosts in Active Directory. 1,2,3 Parameter From the vSphere client home page select \"Host Profiles\". Right click the Host Profile and select Edit. Choose \"Authentication configuration -&gt; Active Directory Configuration -&gt; Join Domain Method\". Set the Join Domain Method to \"Use vSphere Authentication Proxy to add the host to domain\". N/A N/A Site Specific Modify No http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-084B74BD-40A5-4A4B-A82C-0C9912D580DC.html</li>\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION - PART 2','','inherit','open','open','','6914-revision-5','','','2012-06-26 03:01:20','2012-06-26 03:01:20','',6914,'http://egroup.jasonmangone.com/6914-revision-5',0,'revision','',0);
INSERT INTO `wp_posts` VALUES (6925,35,'2012-06-26 03:01:27','2012-06-26 03:01:27','Welcome back to part 2 of our discussion of the vSphere 5.0 Hardening Guide! If you missed part 1, you can find it <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">here</a>. Let\'s get back to it!\r\n<ul>\r\n	<li>Guideline Title: Communication Configure the ESXi host firewall to restrict access to services running on the host\r\n<ul>\r\n	<li>Title: config-firewall-access</li>\r\n	<li>Discussion: The process of hardening a production server involves stopping unnecessary services and protecting services that need to remain running, and ESXi is no different. Unnecessary services should be disabled. Necessary services can be protected by defining allowed IPs that are allowed to connect. These IPs can be set under \"Configuration -&gt; Security Profile -&gt; Firewall -&gt; Properties\". Select a service then click \"Firewall\", choose \"Only allow connections from the following networks\" and specify the IPs or ranges that will be allowed to connect.\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png\"><img class=\"alignnone  wp-image-6923\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png\" alt=\"\" width=\"374\" height=\"236\" /></a></li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-DD4322FF-3DC4-4716-8819-6688938F99D7.html\">Official VMware Documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>config-ntp vSphere 5.0 ESXI Communication Configure NTP time synchronization By ensuring that all systems use the same relative time source (including the relevant localization offset), and that the relative time source can be correlated to an agreed-upon time standard (such as Coordinated Universal Time—UTC), you can make it simpler to track and correlate an intruder’s actions when reviewing the relevant log files. Incorrect time settings can make it difficult to inspect and correlate log files to detect attacks, and can make auditing inaccurate. 1,2,3 Parameter From the vSphere Client: Select the host and click \"Configuration -&gt; Time Configuration\". Select the properties link and chose \'Options\'. From the General tab start the NTP service and select \"Start and stop with host\". From the NTP Settings tab click the \' Add\' button to add the site specific NTP servers. NTP can also be configured using the vCLI or PowerCLI. It is recommended to synchronize the ESXi clock with a time server that is located on the management network rather than directly with a time server on a public network. This time server can then synchronize with a public source through a strictly controlled network connection with a firewall. Note: Verify the required firewall ports are open. /etc/ntp.conf N/A Site Specific Modify No http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_networks.11.8.html</li>\r\n	<li>config-snmp vSphere 5.0 ESXI Communication Ensure proper SNMP configuration If SNMP is not being used, it should remain disabled. If it is being used, the proper trap destination should be configured. If SNMP is not properly configured, monitoring information can be sent to a malicious host that can then use this information to plan an attack. 1,2,3 Parameter Run \"vicfg-snmp &lt;conn_options&gt; --show\" to determine if SNMP is being used. If SNMP is not being used, make sure that it is not running: \"vicfg-snmp &lt;conn_options&gt; --disable&gt;. If SNMP is being used, refer to the vSphere Command-Line Interface Concepts and Examples guide, Chapter 10 for steps to make sure the parameters are properly configured. SNMP must be configured on each ESXi host using either vCLI or PowerCLI, or using an API client. /etc/vmware/snmp.xml N/A site-specific Modify N/A http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.monitoring.doc_50/GUID-8EF36D7D-59B6-4C74-B1AA-4A9D18AB6250.html</li>\r\n	<li>disable-mob vSphere 5.0 ESXI Communication Disable Managed Object Browser (MOB) The managed object browser (MOB) provides a way to explore the object model used by the VMkernel to manage the host; it enables configurations to be changed as well. This interface is meant to be used primarily for debugging the vSphere SDK but because there are no access controls it could also be used as a method obtain information about a host being targeted for unauthorized access. 1,2,3 Parameter To determine if the MOB is enabled run the following command on the ESXi shell: ~# vim-cmd proxysvc/service_list. To disable the MOB run the following command: ~# vim-cmd proxysvc/remove_service \"/mob\" \"httpsWithRedirect\". Note: You cannot disable MOB while in lockdown mode. N/A N/A Remove Service Remove No The MOB will no longer be available for diagnostics. Some 3rd party tools use this interface to gather information. Testing should be done after disabling the MOB to verify 3rd party applications are still functioning as expected. To re-enable the MOB: ~ # vim-cmd proxysvc/add_np_service \"/mob\" httpsWithRedirect /var/run/vmware/proxy-mob http://kb.vmware.com/kb/1016039</li>\r\n	<li>enable-auth-proxy vSphere 5.0 ESXI Communication When adding ESXi hosts to Active Directory use the vSphere Authentication Proxy to protect passwords If you configure your host to join an Active Directory domain using host profiles, the passwords used to authenticate the host are not protected. To avoid transmitting clear text passwords use the vSphere Authentication Proxy to configure hosts in Active Directory. 1,2,3 Parameter From the vSphere client home page select \"Host Profiles\". Right click the Host Profile and select Edit. Choose \"Authentication configuration -&gt; Active Directory Configuration -&gt; Join Domain Method\". Set the Join Domain Method to \"Use vSphere Authentication Proxy to add the host to domain\". N/A N/A Site Specific Modify No http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-084B74BD-40A5-4A4B-A82C-0C9912D580DC.html</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION - PART 2','','inherit','open','open','','6914-revision-6','','','2012-06-26 03:01:27','2012-06-26 03:01:27','',6914,'http://egroup.jasonmangone.com/6914-revision-6',0,'revision','',0),(6926,35,'2012-06-26 02:10:21','2012-06-26 02:10:21','VMware released the <a href=\"http://communities.vmware.com/docs/DOC-19605\">vSphere 5.0 Hardening Guide</a> this month and I wanted to take the opportunity to blog my way through it in order to increase my familiarity, heighten its visibility, and provide a forum for discussion of the recommendations and methods to implement an assessment in your own environment.\r\n\r\nSince the hypervisor is the heart of your datacenter, let\'s start with the ESXi guidelines:\r\n<ul>\r\n	<li>Guideline Title: Use Active Directory for local user authentication\r\n<ul>\r\n	<li>Title: enable-ad-auth</li>\r\n	<li>Discussion: The credentials to your ESXi hosts are among the most sensitive in your entire datacenter. The root password should only be given to personnel that have an explicit need for it. Other users that need to login to hosts outside of vCenter can have permissions granted to their Active Directory account. David Davis has a <a href=\"http://blogs.vmware.com/esxi/2011/01/esxi-41-active-directory-integration.html\">great video</a> demonstrating the process. By default, an AD group names \"ESX Admins\" is checked for and all members will have full rights to all hosts.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc_50%2FGUID-25A5EB3B-7BB1-4B0B-9323-926AE6F0667F.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Establish a password policy for password complexity\r\n<ul>\r\n	<li>Title: set-password-complexity</li>\r\n	<li>Discussion: This setting is used to enforce strong passwords for local accounts. You know, the local accounts you\'re not using since all your hosts are joined to AD, right? But seriously, this is a great setting to use to force users to pick strong passwords, even if your hosts have no local users. Configuration drift happens, so let\'s plan ahead and make sure these users will have strong passwords. Using vi, you\'ll edit the file /etc/pam.d/passwd and modify the third line. The default value is \"password requisite /lib/security/$ISA/pam_passwdqc.so retry=3 min=8,8,8,7,6\". The retry value controls how many attempts users get to pick a strong password. The last 5 numbers control your desired complexity settings, in the following order and referencing four character classes (uppercase letters, lowercase letters, numbers, and symbols/special characters):\r\n<ul>\r\n	<li>The first digit is the minimum length for passwords containing characters from 1 of the classes (least complex, e.g. using \"password\" as your password). You\'ll want this to be a very large number.</li>\r\n	<li>The second digit is the minimum length for password containing characters from 2 of the classes. You\'ll also want this to be a very large number.</li>\r\n	<li>The third digit is the minimum length of SSL certificate passphrases</li>\r\n	<li>The fourth digit is the minimum length for password containing characters from 3 of the classes. Now were getting into reasonable passwords, so allow whatever reasonable length your organization permits.</li>\r\n	<li>The fifth digit is the minimum length for password containing characters from 4 of the classes (most complex, e.g. using \"p4$wOrd\" as your password\"). Same as the previous line.</li>\r\n</ul>\r\n</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc_50%2FGUID-942E8E23-D2CE-49B0-8B39-F31EF6D0519B.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Verify Active Directory \"ESX Admin\" group membership.\r\n<ul>\r\n	<li>Title: verify-admin-group</li>\r\n	<li>Discussion: now that our hosts are joined to AD (first bullet point above), we want to audit the membership of \"ESX Admins\" since those users will automatically have root-level permissions to our hosts. This is a manual check, but you\'ll also want to automate it so that it can run regularly. You can write a scheduled Powershell script to read the group membership and email you the contents on a schedule, or products like ADAudit Plus from ManageEngine are perfect for this task and can email you only when group membership changes.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/1025569\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Ensure that vpxuser auto-password change meets policy.\r\n<ul>\r\n	<li>Title: vpxuser-password-age</li>\r\n	<li>Discussion: ESXi contains a built-in user account called vpxuser. This account has Administrator-level permissions to the local host and is used by vCenter to execute tasks. vCenter sets this password and changes it automatically every 30 days. If your organization requires more frequent password changes, you can change this from the vSphere client by selecting \"Administration -&gt; vCenter Server Settings -&gt; Advanced Settings\" and changing VirtualCenter.VimPasswordExpirationInDays to your desired interval.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc_50%2FGUID-20FA4157-F371-4922-92E8-63822FA808FA.html\">Official VMware Documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li> Guideline Title: Ensure that vpxuser password meets length policy.\r\n<ul>\r\n	<li>Title:vpxuser-password-length</li>\r\n	<li>Discussion: Similar to the guideline above, this check confirms that the password length for the vpxuser password is long enough to comply with your organization\'s security policy. By default it is set to 32 characters. To increase this password length, modify the \"vpxd.hostPasswordLength\" value in the vpxd.cfg file. On Windows this file is located at C:\\Documents and Settings\\All Users\\Application Data\\VMware\\VMware VirtualCenter\\vpxd.cfg  or on the vCenter Server Appliance you\'ll find it at /etc/vmware-vpx/vpxd.cfg.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc_50%2FGUID-20FA4157-F371-4922-92E8-63822FA808FA.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>\r\nThat\'s it for today! I\'ll see you all back here tomorrow to continue our discussion on the vSphere 5.0 Hardening Guide.','VSPHERE 5.0 HARDENING GUIDE DISCUSSION - PART 1','','inherit','open','open','','6904-revision-8','','','2012-06-26 02:10:21','2012-06-26 02:10:21','',6904,'http://egroup.jasonmangone.com/6904-revision-8',0,'revision','',0),(6927,35,'2012-06-26 03:33:27','2012-06-26 03:33:27','Welcome back to part 2 of our discussion of the vSphere 5.0 Hardening Guide! If you missed part 1, you can find it <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">here</a>. Let\'s get back to it!\n<ul>\n	<li>Guideline Title: Communication Configure the ESXi host firewall to restrict access to services running on the host\n<ul>\n	<li>Title: config-firewall-access</li>\n	<li>Discussion: The process of hardening a production server involves stopping unnecessary services and protecting services that need to remain running, and ESXi is no different. Unnecessary services should be disabled. Necessary services can be protected by defining allowed IPs that are allowed to connect. These IPs can be set under \"Configuration -&gt; Security Profile -&gt; Firewall -&gt; Properties\". Select a service then click \"Firewall\", choose \"Only allow connections from the following networks\" and specify the IPs or ranges that will be allowed to connect.\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png\"><img class=\"alignnone  wp-image-6923\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png\" alt=\"\" width=\"374\" height=\"236\" /></a></li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-DD4322FF-3DC4-4716-8819-6688938F99D7.html\">Official VMware Documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title: Configure NTP time synchronization\n<ul>\n	<li>Title: config-ntp</li>\n	<li>Discussion: NTP serves two purposes. First,  in the event of a security breach, having your ESXi system logs synchronized will lend itself to an effective incident postmortem, which can, in turn, help increase the security of your environment and further remediate vulnerabilities. Second,  NTP will be used by any VMs that utilize the VMware Tools time synchronization. When the host has accurate time, the VMs using it as a time source will also. I prefer to pick a single device inside the firewall (possibly the firewall itself) to serve as my internal NTP source. Then I have all my other hosts sync against that device. This means that if the internet connection goes down, only one system notices and the rest of the systems all stay in sync with each other, though not necessarily with the rest of the world. So set an NTP server choose \"Configuration -&gt; Time Configuration -&gt; Options -&gt; start the NTP service and select \"Start and stop with host\"\". Click \'Add\' and specify your site\'s NTP servers.</li>\n	<li>Official VMware documentation</li>\n</ul>\n</li>\n	<li>config-snmp vSphere 5.0 ESXI Communication Ensure proper SNMP configuration If SNMP is not being used, it should remain disabled. If it is being used, the proper trap destination should be configured. If SNMP is not properly configured, monitoring information can be sent to a malicious host that can then use this information to plan an attack. 1,2,3 Parameter Run \"vicfg-snmp &lt;conn_options&gt; --show\" to determine if SNMP is being used. If SNMP is not being used, make sure that it is not running: \"vicfg-snmp &lt;conn_options&gt; --disable&gt;. If SNMP is being used, refer to the vSphere Command-Line Interface Concepts and Examples guide, Chapter 10 for steps to make sure the parameters are properly configured. SNMP must be configured on each ESXi host using either vCLI or PowerCLI, or using an API client. /etc/vmware/snmp.xml N/A site-specific Modify N/A http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.monitoring.doc_50/GUID-8EF36D7D-59B6-4C74-B1AA-4A9D18AB6250.html</li>\n	<li>disable-mob vSphere 5.0 ESXI Communication Disable Managed Object Browser (MOB) The managed object browser (MOB) provides a way to explore the object model used by the VMkernel to manage the host; it enables configurations to be changed as well. This interface is meant to be used primarily for debugging the vSphere SDK but because there are no access controls it could also be used as a method obtain information about a host being targeted for unauthorized access. 1,2,3 Parameter To determine if the MOB is enabled run the following command on the ESXi shell: ~# vim-cmd proxysvc/service_list. To disable the MOB run the following command: ~# vim-cmd proxysvc/remove_service \"/mob\" \"httpsWithRedirect\". Note: You cannot disable MOB while in lockdown mode. N/A N/A Remove Service Remove No The MOB will no longer be available for diagnostics. Some 3rd party tools use this interface to gather information. Testing should be done after disabling the MOB to verify 3rd party applications are still functioning as expected. To re-enable the MOB: ~ # vim-cmd proxysvc/add_np_service \"/mob\" httpsWithRedirect /var/run/vmware/proxy-mob http://kb.vmware.com/kb/1016039</li>\n	<li>enable-auth-proxy vSphere 5.0 ESXI Communication When adding ESXi hosts to Active Directory use the vSphere Authentication Proxy to protect passwords If you configure your host to join an Active Directory domain using host profiles, the passwords used to authenticate the host are not protected. To avoid transmitting clear text passwords use the vSphere Authentication Proxy to configure hosts in Active Directory. 1,2,3 Parameter From the vSphere client home page select \"Host Profiles\". Right click the Host Profile and select Edit. Choose \"Authentication configuration -&gt; Active Directory Configuration -&gt; Join Domain Method\". Set the Join Domain Method to \"Use vSphere Authentication Proxy to add the host to domain\". N/A N/A Site Specific Modify No http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-084B74BD-40A5-4A4B-A82C-0C9912D580DC.html</li>\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION - PART 2','','inherit','open','open','','6914-revision-7','','','2012-06-26 03:33:27','2012-06-26 03:33:27','',6914,'http://egroup.jasonmangone.com/6914-revision-7',0,'revision','',0),(6928,35,'2012-06-26 03:33:38','2012-06-26 03:33:38','Welcome back to part 2 of our discussion of the vSphere 5.0 Hardening Guide! If you missed part 1, you can find it <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">here</a>. Let\'s get back to it!\r\n<ul>\r\n	<li>Guideline Title: Communication Configure the ESXi host firewall to restrict access to services running on the host\r\n<ul>\r\n	<li>Title: config-firewall-access</li>\r\n	<li>Discussion: The process of hardening a production server involves stopping unnecessary services and protecting services that need to remain running, and ESXi is no different. Unnecessary services should be disabled. Necessary services can be protected by defining allowed IPs that are allowed to connect. These IPs can be set under \"Configuration -&gt; Security Profile -&gt; Firewall -&gt; Properties\". Select a service then click \"Firewall\", choose \"Only allow connections from the following networks\" and specify the IPs or ranges that will be allowed to connect.\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png\"><img class=\"alignnone  wp-image-6923\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png\" alt=\"\" width=\"374\" height=\"236\" /></a></li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-DD4322FF-3DC4-4716-8819-6688938F99D7.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Configure NTP time synchronization\r\n<ul>\r\n	<li>Title: config-ntp</li>\r\n	<li>Discussion: NTP serves two purposes. First,  in the event of a security breach, having your ESXi system logs synchronized will lend itself to an effective incident postmortem, which can, in turn, help increase the security of your environment and further remediate vulnerabilities. Second,  NTP will be used by any VMs that utilize the VMware Tools time synchronization. When the host has accurate time, the VMs using it as a time source will also. I prefer to pick a single device inside the firewall (possibly the firewall itself) to serve as my internal NTP source. Then I have all my other hosts sync against that device. This means that if the internet connection goes down, only one system notices and the rest of the systems all stay in sync with each other, though not necessarily with the rest of the world. So set an NTP server choose \"Configuration -&gt; Time Configuration -&gt; Options -&gt; start the NTP service and select \"Start and stop with host\"\". Click \'Add\' and specify your site\'s NTP servers.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_networks.11.8.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>config-snmp vSphere 5.0 ESXI Communication Ensure proper SNMP configuration If SNMP is not being used, it should remain disabled. If it is being used, the proper trap destination should be configured. If SNMP is not properly configured, monitoring information can be sent to a malicious host that can then use this information to plan an attack. 1,2,3 Parameter Run \"vicfg-snmp &lt;conn_options&gt; --show\" to determine if SNMP is being used. If SNMP is not being used, make sure that it is not running: \"vicfg-snmp &lt;conn_options&gt; --disable&gt;. If SNMP is being used, refer to the vSphere Command-Line Interface Concepts and Examples guide, Chapter 10 for steps to make sure the parameters are properly configured. SNMP must be configured on each ESXi host using either vCLI or PowerCLI, or using an API client. /etc/vmware/snmp.xml N/A site-specific Modify N/A http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.monitoring.doc_50/GUID-8EF36D7D-59B6-4C74-B1AA-4A9D18AB6250.html</li>\r\n	<li>disable-mob vSphere 5.0 ESXI Communication Disable Managed Object Browser (MOB) The managed object browser (MOB) provides a way to explore the object model used by the VMkernel to manage the host; it enables configurations to be changed as well. This interface is meant to be used primarily for debugging the vSphere SDK but because there are no access controls it could also be used as a method obtain information about a host being targeted for unauthorized access. 1,2,3 Parameter To determine if the MOB is enabled run the following command on the ESXi shell: ~# vim-cmd proxysvc/service_list. To disable the MOB run the following command: ~# vim-cmd proxysvc/remove_service \"/mob\" \"httpsWithRedirect\". Note: You cannot disable MOB while in lockdown mode. N/A N/A Remove Service Remove No The MOB will no longer be available for diagnostics. Some 3rd party tools use this interface to gather information. Testing should be done after disabling the MOB to verify 3rd party applications are still functioning as expected. To re-enable the MOB: ~ # vim-cmd proxysvc/add_np_service \"/mob\" httpsWithRedirect /var/run/vmware/proxy-mob http://kb.vmware.com/kb/1016039</li>\r\n	<li>enable-auth-proxy vSphere 5.0 ESXI Communication When adding ESXi hosts to Active Directory use the vSphere Authentication Proxy to protect passwords If you configure your host to join an Active Directory domain using host profiles, the passwords used to authenticate the host are not protected. To avoid transmitting clear text passwords use the vSphere Authentication Proxy to configure hosts in Active Directory. 1,2,3 Parameter From the vSphere client home page select \"Host Profiles\". Right click the Host Profile and select Edit. Choose \"Authentication configuration -&gt; Active Directory Configuration -&gt; Join Domain Method\". Set the Join Domain Method to \"Use vSphere Authentication Proxy to add the host to domain\". N/A N/A Site Specific Modify No http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-084B74BD-40A5-4A4B-A82C-0C9912D580DC.html</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION - PART 2','','inherit','open','open','','6914-revision-8','','','2012-06-26 03:33:38','2012-06-26 03:33:38','',6914,'http://egroup.jasonmangone.com/6914-revision-8',0,'revision','',0),(6929,35,'2012-06-26 03:50:40','2012-06-26 03:50:40','Welcome back to part 2 of our discussion of the vSphere 5.0 Hardening Guide! If you missed part 1, you can find it <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">here</a>. Let\'s get back to it!\n<ul>\n	<li>Guideline Title: Communication Configure the ESXi host firewall to restrict access to services running on the host\n<ul>\n	<li>Title: config-firewall-access</li>\n	<li>Discussion: The process of hardening a production server involves stopping unnecessary services and protecting services that need to remain running, and ESXi is no different. Unnecessary services should be disabled. Necessary services can be protected by defining allowed IPs that are allowed to connect. These IPs can be set under \"Configuration -&gt; Security Profile -&gt; Firewall -&gt; Properties\". Select a service then click \"Firewall\", choose \"Only allow connections from the following networks\" and specify the IPs or ranges that will be allowed to connect.\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png\"><img class=\"alignnone  wp-image-6923\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png\" alt=\"\" width=\"374\" height=\"236\" /></a></li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-DD4322FF-3DC4-4716-8819-6688938F99D7.html\">Official VMware documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title: Configure NTP time synchronization\n<ul>\n	<li>Title: config-ntp</li>\n	<li>Discussion: NTP serves two purposes. First,  in the event of a security breach, having your ESXi system logs synchronized will lend itself to an effective incident postmortem, which can, in turn, help increase the security of your environment and further remediate vulnerabilities. Second,  NTP will be used by any VMs that utilize the VMware Tools time synchronization. When the host has accurate time, the VMs using it as a time source will also. I prefer to pick a single device inside the firewall (possibly the firewall itself) to serve as my internal NTP source. Then I have all my other hosts sync against that device. This means that if the internet connection goes down, only one system notices and the rest of the systems all stay in sync with each other, though not necessarily with the rest of the world. So set an NTP server choose \"Configuration -&gt; Time Configuration -&gt; Options -&gt; start the NTP service and select \"Start and stop with host\"\". Click \'Add\' and specify your site\'s NTP servers.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_networks.11.8.html\">Official VMware documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title: Ensure proper SNMP configuration\n<ul>\n	<li>Title: config-snmp</li>\n	<li>Discussion: SNMP is a protocol for monitoring network resources (hosts, servers, switches, etc). If your environment is not using SNMP</li>\n	<li>vSphere 5.0 ESXI Communication  If SNMP is not being used, it should remain disabled. If it is being used, the proper trap destination should be configured. If SNMP is not properly configured, monitoring information can be sent to a malicious host that can then use this information to plan an attack. 1,2,3 Parameter Run \"vicfg-snmp &lt;conn_options&gt; --show\" to determine if SNMP is being used. If SNMP is not being used, make sure that it is not running: \"vicfg-snmp &lt;conn_options&gt; --disable&gt;. If SNMP is being used, refer to the vSphere Command-Line Interface Concepts and Examples guide, Chapter 10 for steps to make sure the parameters are properly configured. SNMP must be configured on each ESXi host using either vCLI or PowerCLI, or using an API client. /etc/vmware/snmp.xml N/A site-specific Modify N/A http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.monitoring.doc_50/GUID-8EF36D7D-59B6-4C74-B1AA-4A9D18AB6250.html</li>\n</ul>\n</li>\n	<li>disable-mob vSphere 5.0 ESXI Communication Disable Managed Object Browser (MOB) The managed object browser (MOB) provides a way to explore the object model used by the VMkernel to manage the host; it enables configurations to be changed as well. This interface is meant to be used primarily for debugging the vSphere SDK but because there are no access controls it could also be used as a method obtain information about a host being targeted for unauthorized access. 1,2,3 Parameter To determine if the MOB is enabled run the following command on the ESXi shell: ~# vim-cmd proxysvc/service_list. To disable the MOB run the following command: ~# vim-cmd proxysvc/remove_service \"/mob\" \"httpsWithRedirect\". Note: You cannot disable MOB while in lockdown mode. N/A N/A Remove Service Remove No The MOB will no longer be available for diagnostics. Some 3rd party tools use this interface to gather information. Testing should be done after disabling the MOB to verify 3rd party applications are still functioning as expected. To re-enable the MOB: ~ # vim-cmd proxysvc/add_np_service \"/mob\" httpsWithRedirect /var/run/vmware/proxy-mob http://kb.vmware.com/kb/1016039</li>\n	<li>enable-auth-proxy vSphere 5.0 ESXI Communication When adding ESXi hosts to Active Directory use the vSphere Authentication Proxy to protect passwords If you configure your host to join an Active Directory domain using host profiles, the passwords used to authenticate the host are not protected. To avoid transmitting clear text passwords use the vSphere Authentication Proxy to configure hosts in Active Directory. 1,2,3 Parameter From the vSphere client home page select \"Host Profiles\". Right click the Host Profile and select Edit. Choose \"Authentication configuration -&gt; Active Directory Configuration -&gt; Join Domain Method\". Set the Join Domain Method to \"Use vSphere Authentication Proxy to add the host to domain\". N/A N/A Site Specific Modify No http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-084B74BD-40A5-4A4B-A82C-0C9912D580DC.html</li>\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION - PART 2','','inherit','open','open','','6914-revision-9','','','2012-06-26 03:50:40','2012-06-26 03:50:40','',6914,'http://egroup.jasonmangone.com/6914-revision-9',0,'revision','',0),(6932,35,'2012-06-26 04:05:48','2012-06-26 04:05:48','Welcome back to part 2 of our discussion of the vSphere 5.0 Hardening Guide! If you missed part 1, you can find it <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">here</a>. Let\'s get back to it!\r\n<ul>\r\n	<li>Guideline Title: Communication Configure the ESXi host firewall to restrict access to services running on the host\r\n<ul>\r\n	<li>Title: config-firewall-access</li>\r\n	<li>Discussion: The process of hardening a production server involves stopping unnecessary services and protecting services that need to remain running, and ESXi is no different. Unnecessary services should be disabled. Necessary services can be protected by defining allowed IPs that are allowed to connect. These IPs can be set under \"Configuration -&gt; Security Profile -&gt; Firewall -&gt; Properties\". Select a service then click \"Firewall\", choose \"Only allow connections from the following networks\" and specify the IPs or ranges that will be allowed to connect.\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png\"><img class=\"alignnone  wp-image-6923\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png\" alt=\"\" width=\"374\" height=\"236\" /></a></li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-DD4322FF-3DC4-4716-8819-6688938F99D7.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Configure NTP time synchronization\r\n<ul>\r\n	<li>Title: config-ntp</li>\r\n	<li>Discussion: NTP serves two purposes. First,  in the event of a security breach, having your ESXi system logs synchronized will lend itself to an effective incident postmortem, which can, in turn, help increase the security of your environment and further remediate vulnerabilities. Second,  NTP will be used by any VMs that utilize the VMware Tools time synchronization. When the host has accurate time, the VMs using it as a time source will also. I prefer to pick a single device inside the firewall (possibly the firewall itself) to serve as my internal NTP source. Then I have all my other hosts sync against that device. This means that if the internet connection goes down, only one system notices and the rest of the systems all stay in sync with each other, though not necessarily with the rest of the world. So set an NTP server choose \"Configuration -&gt; Time Configuration -&gt; Options -&gt; start the NTP service and select \"Start and stop with host\"\". Click \'Add\' and specify your site\'s NTP servers.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_networks.11.8.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Ensure proper SNMP configuration\r\n<ul>\r\n	<li>Title: config-snmp</li>\r\n	<li>Discussion: SNMP is a protocol for monitoring network resources (hosts, servers, switches, etc). If your environment is not using SNMP, it should be disabled to avoid disclosing ESXi host status information to malicious observers. (Of course, if you\'re following along, you\'ve already locked down which IPs and ranges can reach the SNMP agent!) The ESXi SNMP agent is disabled by default. To confirm this, run \"vicfg-snmp &lt;conn_options&gt; --show\", or to disable it in environments where it is not used, run \"vicfg-snmp &lt;conn_options&gt; --disable\". If SNMP is being used, make sure the parameters are properly configured using either vCLI or PowerCLI, or using an API client.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.monitoring.doc_50/GUID-8EF36D7D-59B6-4C74-B1AA-4A9D18AB6250.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Disable Managed Object Browser (MOB)\r\n<ul>\r\n	<li>Title: disable-mob</li>\r\n	<li>Discussion: I can\'t put it any better than the VMware-provided description for this vulnerability already has. I\'ll quote it directly from the Hardening Guidelines below.\r\n<ul>\r\n	<li>\"The managed object browser (MOB) provides a way to explore the object model used by the VMkernel to manage the host; it enables configurations to be changed as well. This interface is meant to be used primarily for debugging the vSphere SDK but because there are no access controls it could also be used as a method obtain information about a host being targeted for unauthorized access. To determine if the MOB is enabled run the following command on the ESXi shell: \"vim-cmd proxysvc/service_list\". To disable the MOB run the following command: \"vim-cmd proxysvc/remove_service \"/mob\" \"httpsWithRedirect\"\". Note: You cannot disable MOB while in lockdown mode. The MOB will no longer be available for diagnostics. Some 3rd party tools use this interface to gather information. Testing should be done after disabling the MOB to verify 3rd party applications are still functioning as expected. To re-enable the MOB: ~ # vim-cmd proxysvc/add_np_service \"/mob\" httpsWithRedirect\"</li>\r\n</ul>\r\n</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/1016039\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>enable-auth-proxy vSphere 5.0 ESXI Communication When adding ESXi hosts to Active Directory use the vSphere Authentication Proxy to protect passwords If you configure your host to join an Active Directory domain using host profiles, the passwords used to authenticate the host are not protected. To avoid transmitting clear text passwords use the vSphere Authentication Proxy to configure hosts in Active Directory. 1,2,3 Parameter From the vSphere client home page select \"Host Profiles\". Right click the Host Profile and select Edit. Choose \"Authentication configuration -&gt; Active Directory Configuration -&gt; Join Domain Method\". Set the Join Domain Method to \"Use vSphere Authentication Proxy to add the host to domain\". N/A N/A Site Specific Modify No http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-084B74BD-40A5-4A4B-A82C-0C9912D580DC.html</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION - PART 2','','inherit','open','open','','6914-revision-12','','','2012-06-26 04:05:48','2012-06-26 04:05:48','',6914,'http://egroup.jasonmangone.com/6914-revision-12',0,'revision','',0),(6930,35,'2012-06-26 03:52:18','2012-06-26 03:52:18','Welcome back to part 2 of our discussion of the vSphere 5.0 Hardening Guide! If you missed part 1, you can find it <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">here</a>. Let\'s get back to it!\r\n<ul>\r\n	<li>Guideline Title: Communication Configure the ESXi host firewall to restrict access to services running on the host\r\n<ul>\r\n	<li>Title: config-firewall-access</li>\r\n	<li>Discussion: The process of hardening a production server involves stopping unnecessary services and protecting services that need to remain running, and ESXi is no different. Unnecessary services should be disabled. Necessary services can be protected by defining allowed IPs that are allowed to connect. These IPs can be set under \"Configuration -&gt; Security Profile -&gt; Firewall -&gt; Properties\". Select a service then click \"Firewall\", choose \"Only allow connections from the following networks\" and specify the IPs or ranges that will be allowed to connect.\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png\"><img class=\"alignnone  wp-image-6923\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png\" alt=\"\" width=\"374\" height=\"236\" /></a></li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-DD4322FF-3DC4-4716-8819-6688938F99D7.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Configure NTP time synchronization\r\n<ul>\r\n	<li>Title: config-ntp</li>\r\n	<li>Discussion: NTP serves two purposes. First,  in the event of a security breach, having your ESXi system logs synchronized will lend itself to an effective incident postmortem, which can, in turn, help increase the security of your environment and further remediate vulnerabilities. Second,  NTP will be used by any VMs that utilize the VMware Tools time synchronization. When the host has accurate time, the VMs using it as a time source will also. I prefer to pick a single device inside the firewall (possibly the firewall itself) to serve as my internal NTP source. Then I have all my other hosts sync against that device. This means that if the internet connection goes down, only one system notices and the rest of the systems all stay in sync with each other, though not necessarily with the rest of the world. So set an NTP server choose \"Configuration -&gt; Time Configuration -&gt; Options -&gt; start the NTP service and select \"Start and stop with host\"\". Click \'Add\' and specify your site\'s NTP servers.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_networks.11.8.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Ensure proper SNMP configuration\r\n<ul>\r\n	<li>Title: config-snmp</li>\r\n	<li>Discussion: SNMP is a protocol for monitoring network resources (hosts, servers, switches, etc). If your environment is not using SNMP</li>\r\n	<li>vSphere 5.0 ESXI Communication  If SNMP is not being used, it should remain disabled. If it is being used, the proper trap destination should be configured. If SNMP is not properly configured, monitoring information can be sent to a malicious host that can then use this information to plan an attack. 1,2,3 Parameter Run \"vicfg-snmp &lt;conn_options&gt; --show\" to determine if SNMP is being used. If SNMP is not being used, make sure that it is not running: \"vicfg-snmp &lt;conn_options&gt; --disable&gt;. If SNMP is being used, refer to the vSphere Command-Line Interface Concepts and Examples guide, Chapter 10 for steps to make sure the parameters are properly configured. SNMP must be configured on each ESXi host using either vCLI or PowerCLI, or using an API client. /etc/vmware/snmp.xml N/A site-specific Modify N/A</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.monitoring.doc_50/GUID-8EF36D7D-59B6-4C74-B1AA-4A9D18AB6250.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>disable-mob vSphere 5.0 ESXI Communication Disable Managed Object Browser (MOB) The managed object browser (MOB) provides a way to explore the object model used by the VMkernel to manage the host; it enables configurations to be changed as well. This interface is meant to be used primarily for debugging the vSphere SDK but because there are no access controls it could also be used as a method obtain information about a host being targeted for unauthorized access. 1,2,3 Parameter To determine if the MOB is enabled run the following command on the ESXi shell: ~# vim-cmd proxysvc/service_list. To disable the MOB run the following command: ~# vim-cmd proxysvc/remove_service \"/mob\" \"httpsWithRedirect\". Note: You cannot disable MOB while in lockdown mode. N/A N/A Remove Service Remove No The MOB will no longer be available for diagnostics. Some 3rd party tools use this interface to gather information. Testing should be done after disabling the MOB to verify 3rd party applications are still functioning as expected. To re-enable the MOB: ~ # vim-cmd proxysvc/add_np_service \"/mob\" httpsWithRedirect /var/run/vmware/proxy-mob http://kb.vmware.com/kb/1016039</li>\r\n	<li>enable-auth-proxy vSphere 5.0 ESXI Communication When adding ESXi hosts to Active Directory use the vSphere Authentication Proxy to protect passwords If you configure your host to join an Active Directory domain using host profiles, the passwords used to authenticate the host are not protected. To avoid transmitting clear text passwords use the vSphere Authentication Proxy to configure hosts in Active Directory. 1,2,3 Parameter From the vSphere client home page select \"Host Profiles\". Right click the Host Profile and select Edit. Choose \"Authentication configuration -&gt; Active Directory Configuration -&gt; Join Domain Method\". Set the Join Domain Method to \"Use vSphere Authentication Proxy to add the host to domain\". N/A N/A Site Specific Modify No http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-084B74BD-40A5-4A4B-A82C-0C9912D580DC.html</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION - PART 2','','inherit','open','open','','6914-revision-10','','','2012-06-26 03:52:18','2012-06-26 03:52:18','',6914,'http://egroup.jasonmangone.com/6914-revision-10',0,'revision','',0),(6931,35,'2012-06-26 03:52:32','2012-06-26 03:52:32','Welcome back to part 2 of our discussion of the vSphere 5.0 Hardening Guide! If you missed part 1, you can find it <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">here</a>. Let\'s get back to it!\r\n<ul>\r\n	<li>Guideline Title: Communication Configure the ESXi host firewall to restrict access to services running on the host\r\n<ul>\r\n	<li>Title: config-firewall-access</li>\r\n	<li>Discussion: The process of hardening a production server involves stopping unnecessary services and protecting services that need to remain running, and ESXi is no different. Unnecessary services should be disabled. Necessary services can be protected by defining allowed IPs that are allowed to connect. These IPs can be set under \"Configuration -&gt; Security Profile -&gt; Firewall -&gt; Properties\". Select a service then click \"Firewall\", choose \"Only allow connections from the following networks\" and specify the IPs or ranges that will be allowed to connect.\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png\"><img class=\"alignnone  wp-image-6923\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png\" alt=\"\" width=\"374\" height=\"236\" /></a></li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-DD4322FF-3DC4-4716-8819-6688938F99D7.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Configure NTP time synchronization\r\n<ul>\r\n	<li>Title: config-ntp</li>\r\n	<li>Discussion: NTP serves two purposes. First,  in the event of a security breach, having your ESXi system logs synchronized will lend itself to an effective incident postmortem, which can, in turn, help increase the security of your environment and further remediate vulnerabilities. Second,  NTP will be used by any VMs that utilize the VMware Tools time synchronization. When the host has accurate time, the VMs using it as a time source will also. I prefer to pick a single device inside the firewall (possibly the firewall itself) to serve as my internal NTP source. Then I have all my other hosts sync against that device. This means that if the internet connection goes down, only one system notices and the rest of the systems all stay in sync with each other, though not necessarily with the rest of the world. So set an NTP server choose \"Configuration -&gt; Time Configuration -&gt; Options -&gt; start the NTP service and select \"Start and stop with host\"\". Click \'Add\' and specify your site\'s NTP servers.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_networks.11.8.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Ensure proper SNMP configuration\r\n<ul>\r\n	<li>Title: config-snmp</li>\r\n	<li>Discussion: SNMP is a protocol for monitoring network resources (hosts, servers, switches, etc). If your environment is not using SNMP</li>\r\n	<li>vSphere 5.0 ESXI Communication  If SNMP is not being used, it should remain disabled. If it is being used, the proper trap destination should be configured. If SNMP is not properly configured, monitoring information can be sent to a malicious host that can then use this information to plan an attack. 1,2,3 Parameter Run \"vicfg-snmp &lt;conn_options&gt; --show\" to determine if SNMP is being used. If SNMP is not being used, make sure that it is not running: \"vicfg-snmp &lt;conn_options&gt; --disable&gt;. If SNMP is being used, refer to the vSphere Command-Line Interface Concepts and Examples guide, Chapter 10 for steps to make sure the parameters are properly configured. SNMP must be configured on each ESXi host using either vCLI or PowerCLI, or using an API client. /etc/vmware/snmp.xml N/A site-specific Modify N/A</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.monitoring.doc_50/GUID-8EF36D7D-59B6-4C74-B1AA-4A9D18AB6250.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>disable-mob vSphere 5.0 ESXI Communication Disable Managed Object Browser (MOB) The managed object browser (MOB) provides a way to explore the object model used by the VMkernel to manage the host; it enables configurations to be changed as well. This interface is meant to be used primarily for debugging the vSphere SDK but because there are no access controls it could also be used as a method obtain information about a host being targeted for unauthorized access. 1,2,3 Parameter To determine if the MOB is enabled run the following command on the ESXi shell: ~# vim-cmd proxysvc/service_list. To disable the MOB run the following command: ~# vim-cmd proxysvc/remove_service \"/mob\" \"httpsWithRedirect\". Note: You cannot disable MOB while in lockdown mode. N/A N/A Remove Service Remove No The MOB will no longer be available for diagnostics. Some 3rd party tools use this interface to gather information. Testing should be done after disabling the MOB to verify 3rd party applications are still functioning as expected. To re-enable the MOB: ~ # vim-cmd proxysvc/add_np_service \"/mob\" httpsWithRedirect /var/run/vmware/proxy-mob http://kb.vmware.com/kb/1016039</li>\r\n	<li>enable-auth-proxy vSphere 5.0 ESXI Communication When adding ESXi hosts to Active Directory use the vSphere Authentication Proxy to protect passwords If you configure your host to join an Active Directory domain using host profiles, the passwords used to authenticate the host are not protected. To avoid transmitting clear text passwords use the vSphere Authentication Proxy to configure hosts in Active Directory. 1,2,3 Parameter From the vSphere client home page select \"Host Profiles\". Right click the Host Profile and select Edit. Choose \"Authentication configuration -&gt; Active Directory Configuration -&gt; Join Domain Method\". Set the Join Domain Method to \"Use vSphere Authentication Proxy to add the host to domain\". N/A N/A Site Specific Modify No http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-084B74BD-40A5-4A4B-A82C-0C9912D580DC.html</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION - PART 2','','inherit','open','open','','6914-revision-11','','','2012-06-26 03:52:32','2012-06-26 03:52:32','',6914,'http://egroup.jasonmangone.com/6914-revision-11',0,'revision','',0),(6933,35,'2012-06-26 04:05:51','2012-06-26 04:05:51','Welcome back to part 2 of our discussion of the vSphere 5.0 Hardening Guide! If you missed part 1, you can find it <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">here</a>. Let\'s get back to it!\r\n<ul>\r\n	<li>Guideline Title: Communication Configure the ESXi host firewall to restrict access to services running on the host\r\n<ul>\r\n	<li>Title: config-firewall-access</li>\r\n	<li>Discussion: The process of hardening a production server involves stopping unnecessary services and protecting services that need to remain running, and ESXi is no different. Unnecessary services should be disabled. Necessary services can be protected by defining allowed IPs that are allowed to connect. These IPs can be set under \"Configuration -&gt; Security Profile -&gt; Firewall -&gt; Properties\". Select a service then click \"Firewall\", choose \"Only allow connections from the following networks\" and specify the IPs or ranges that will be allowed to connect.\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png\"><img class=\"alignnone  wp-image-6923\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png\" alt=\"\" width=\"374\" height=\"236\" /></a></li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-DD4322FF-3DC4-4716-8819-6688938F99D7.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Configure NTP time synchronization\r\n<ul>\r\n	<li>Title: config-ntp</li>\r\n	<li>Discussion: NTP serves two purposes. First,  in the event of a security breach, having your ESXi system logs synchronized will lend itself to an effective incident postmortem, which can, in turn, help increase the security of your environment and further remediate vulnerabilities. Second,  NTP will be used by any VMs that utilize the VMware Tools time synchronization. When the host has accurate time, the VMs using it as a time source will also. I prefer to pick a single device inside the firewall (possibly the firewall itself) to serve as my internal NTP source. Then I have all my other hosts sync against that device. This means that if the internet connection goes down, only one system notices and the rest of the systems all stay in sync with each other, though not necessarily with the rest of the world. So set an NTP server choose \"Configuration -&gt; Time Configuration -&gt; Options -&gt; start the NTP service and select \"Start and stop with host\"\". Click \'Add\' and specify your site\'s NTP servers.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_networks.11.8.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Ensure proper SNMP configuration\r\n<ul>\r\n	<li>Title: config-snmp</li>\r\n	<li>Discussion: SNMP is a protocol for monitoring network resources (hosts, servers, switches, etc). If your environment is not using SNMP, it should be disabled to avoid disclosing ESXi host status information to malicious observers. (Of course, if you\'re following along, you\'ve already locked down which IPs and ranges can reach the SNMP agent!) The ESXi SNMP agent is disabled by default. To confirm this, run \"vicfg-snmp &lt;conn_options&gt; --show\", or to disable it in environments where it is not used, run \"vicfg-snmp &lt;conn_options&gt; --disable\". If SNMP is being used, make sure the parameters are properly configured using either vCLI or PowerCLI, or using an API client.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.monitoring.doc_50/GUID-8EF36D7D-59B6-4C74-B1AA-4A9D18AB6250.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Disable Managed Object Browser (MOB)\r\n<ul>\r\n	<li>Title: disable-mob</li>\r\n	<li>Discussion: I can\'t put it any better than the VMware-provided description for this vulnerability already has. I\'ll quote it directly from the Hardening Guidelines below.\r\n<ul>\r\n	<li>\"The managed object browser (MOB) provides a way to explore the object model used by the VMkernel to manage the host; it enables configurations to be changed as well. This interface is meant to be used primarily for debugging the vSphere SDK but because there are no access controls it could also be used as a method obtain information about a host being targeted for unauthorized access. To determine if the MOB is enabled run the following command on the ESXi shell: \"vim-cmd proxysvc/service_list\". To disable the MOB run the following command: \"vim-cmd proxysvc/remove_service \"/mob\" \"httpsWithRedirect\"\". Note: You cannot disable MOB while in lockdown mode. The MOB will no longer be available for diagnostics. Some 3rd party tools use this interface to gather information. Testing should be done after disabling the MOB to verify 3rd party applications are still functioning as expected. To re-enable the MOB: ~ # vim-cmd proxysvc/add_np_service \"/mob\" httpsWithRedirect\"</li>\r\n</ul>\r\n</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/1016039\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>enable-auth-proxy vSphere 5.0 ESXI Communication When adding ESXi hosts to Active Directory use the vSphere Authentication Proxy to protect passwords If you configure your host to join an Active Directory domain using host profiles, the passwords used to authenticate the host are not protected. To avoid transmitting clear text passwords use the vSphere Authentication Proxy to configure hosts in Active Directory. 1,2,3 Parameter From the vSphere client home page select \"Host Profiles\". Right click the Host Profile and select Edit. Choose \"Authentication configuration -&gt; Active Directory Configuration -&gt; Join Domain Method\". Set the Join Domain Method to \"Use vSphere Authentication Proxy to add the host to domain\". N/A N/A Site Specific Modify No http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-084B74BD-40A5-4A4B-A82C-0C9912D580DC.html</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION - PART 2','','inherit','open','open','','6914-revision-13','','','2012-06-26 04:05:51','2012-06-26 04:05:51','',6914,'http://egroup.jasonmangone.com/6914-revision-13',0,'revision','',0),(6934,35,'2012-06-26 04:13:31','2012-06-26 04:13:31','Welcome back to part 2 of our discussion of the vSphere 5.0 Hardening Guide! If you missed part 1, you can find it <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">here</a>. Let\'s get back to it!\r\n<ul>\r\n	<li>Guideline Title: Communication Configure the ESXi host firewall to restrict access to services running on the host\r\n<ul>\r\n	<li>Title: config-firewall-access</li>\r\n	<li>Discussion: The process of hardening a production server involves stopping unnecessary services and protecting services that need to remain running, and ESXi is no different. Unnecessary services should be disabled. Necessary services can be protected by defining allowed IPs that are allowed to connect. These IPs can be set under \"Configuration -&gt; Security Profile -&gt; Firewall -&gt; Properties\". Select a service then click \"Firewall\", choose \"Only allow connections from the following networks\" and specify the IPs or ranges that will be allowed to connect.\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png\"><img class=\"alignnone  wp-image-6923\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png\" alt=\"\" width=\"374\" height=\"236\" /></a></li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-DD4322FF-3DC4-4716-8819-6688938F99D7.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Configure NTP time synchronization\r\n<ul>\r\n	<li>Title: config-ntp</li>\r\n	<li>Discussion: NTP serves two purposes. First,  in the event of a security breach, having your ESXi system logs synchronized will lend itself to an effective incident postmortem, which can, in turn, help increase the security of your environment and further remediate vulnerabilities. Second,  NTP will be used by any VMs that utilize the VMware Tools time synchronization. When the host has accurate time, the VMs using it as a time source will also. I prefer to pick a single device inside the firewall (possibly the firewall itself) to serve as my internal NTP source. Then I have all my other hosts sync against that device. This means that if the internet connection goes down, only one system notices and the rest of the systems all stay in sync with each other, though not necessarily with the rest of the world. So set an NTP server choose \"Configuration -&gt; Time Configuration -&gt; Options -&gt; start the NTP service and select \"Start and stop with host\"\". Click \'Add\' and specify your site\'s NTP servers.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_networks.11.8.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Ensure proper SNMP configuration\r\n<ul>\r\n	<li>Title: config-snmp</li>\r\n	<li>Discussion: SNMP is a protocol for monitoring network resources (hosts, servers, switches, etc). If your environment is not using SNMP, it should be disabled to avoid disclosing ESXi host status information to malicious observers. (Of course, if you\'re following along, you\'ve already locked down which IPs and ranges can reach the SNMP agent!) The ESXi SNMP agent is disabled by default. To confirm this, run \"vicfg-snmp &lt;conn_options&gt; --show\", or to disable it in environments where it is not used, run \"vicfg-snmp &lt;conn_options&gt; --disable\". If SNMP is being used, make sure the parameters are properly configured using either vCLI or PowerCLI, or using an API client.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.monitoring.doc_50/GUID-8EF36D7D-59B6-4C74-B1AA-4A9D18AB6250.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Disable Managed Object Browser (MOB)\r\n<ul>\r\n	<li>Title: disable-mob</li>\r\n	<li>Discussion: I can\'t put it any better than the VMware-provided description for this vulnerability already has. I\'ll quote it below directly from the Hardening Guidelines.\r\n<ul>\r\n	<li>\"The managed object browser (MOB) provides a way to explore the object model used by the VMkernel to manage the host; it enables configurations to be changed as well. This interface is meant to be used primarily for debugging the vSphere SDK but because there are no access controls it could also be used as a method obtain information about a host being targeted for unauthorized access. To determine if the MOB is enabled run the following command on the ESXi shell: \"vim-cmd proxysvc/service_list\". To disable the MOB run the following command: \"vim-cmd proxysvc/remove_service \"/mob\" \"httpsWithRedirect\"\". Note: You cannot disable MOB while in lockdown mode. The MOB will no longer be available for diagnostics. Some 3rd party tools use this interface to gather information. Testing should be done after disabling the MOB to verify 3rd party applications are still functioning as expected. To re-enable the MOB: ~ # vim-cmd proxysvc/add_np_service \"/mob\" httpsWithRedirect\"</li>\r\n</ul>\r\n</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/1016039\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: When adding ESXi hosts to Active Directory use the vSphere Authentication Proxy to protect passwords\r\n<ul>\r\n	<li>Title: enable-auth-proxy</li>\r\n	<li>Discussion: In environments that use both ESXi Autodeploy and Active Directory to manage hosts, the password used to join Active Directory is sent in cleartext to each host as it boots up, which puts that password at great risk of interception. Instead, VMware provides a vSphere Authentication Proxy to help keep this communication secure. Here are the <a href=\"http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.install.doc_50%2FGUID-EA920335-2608-4127-9B57-DB3809BA4BB9.html\">official deployment instructions</a>.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-084B74BD-40A5-4A4B-A82C-0C9912D580DC.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>\r\nWe\'ll pick this back up tomorrow and knock out another 5 ESXi hardening checks!','VSPHERE 5.0 HARDENING GUIDE DISCUSSION - PART 2','','inherit','open','open','','6914-revision-14','','','2012-06-26 04:13:31','2012-06-26 04:13:31','',6914,'http://egroup.jasonmangone.com/6914-revision-14',0,'revision','',0),(6935,35,'2012-06-26 04:13:34','2012-06-26 04:13:34','Welcome back to part 2 of our discussion of the vSphere 5.0 Hardening Guide! If you missed part 1, you can find it <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">here</a>. Let\'s get back to it!\r\n<ul>\r\n	<li>Guideline Title: Communication Configure the ESXi host firewall to restrict access to services running on the host\r\n<ul>\r\n	<li>Title: config-firewall-access</li>\r\n	<li>Discussion: The process of hardening a production server involves stopping unnecessary services and protecting services that need to remain running, and ESXi is no different. Unnecessary services should be disabled. Necessary services can be protected by defining allowed IPs that are allowed to connect. These IPs can be set under \"Configuration -&gt; Security Profile -&gt; Firewall -&gt; Properties\". Select a service then click \"Firewall\", choose \"Only allow connections from the following networks\" and specify the IPs or ranges that will be allowed to connect.\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png\"><img class=\"alignnone  wp-image-6923\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png\" alt=\"\" width=\"374\" height=\"236\" /></a></li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-DD4322FF-3DC4-4716-8819-6688938F99D7.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Configure NTP time synchronization\r\n<ul>\r\n	<li>Title: config-ntp</li>\r\n	<li>Discussion: NTP serves two purposes. First,  in the event of a security breach, having your ESXi system logs synchronized will lend itself to an effective incident postmortem, which can, in turn, help increase the security of your environment and further remediate vulnerabilities. Second,  NTP will be used by any VMs that utilize the VMware Tools time synchronization. When the host has accurate time, the VMs using it as a time source will also. I prefer to pick a single device inside the firewall (possibly the firewall itself) to serve as my internal NTP source. Then I have all my other hosts sync against that device. This means that if the internet connection goes down, only one system notices and the rest of the systems all stay in sync with each other, though not necessarily with the rest of the world. So set an NTP server choose \"Configuration -&gt; Time Configuration -&gt; Options -&gt; start the NTP service and select \"Start and stop with host\"\". Click \'Add\' and specify your site\'s NTP servers.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_networks.11.8.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Ensure proper SNMP configuration\r\n<ul>\r\n	<li>Title: config-snmp</li>\r\n	<li>Discussion: SNMP is a protocol for monitoring network resources (hosts, servers, switches, etc). If your environment is not using SNMP, it should be disabled to avoid disclosing ESXi host status information to malicious observers. (Of course, if you\'re following along, you\'ve already locked down which IPs and ranges can reach the SNMP agent!) The ESXi SNMP agent is disabled by default. To confirm this, run \"vicfg-snmp &lt;conn_options&gt; --show\", or to disable it in environments where it is not used, run \"vicfg-snmp &lt;conn_options&gt; --disable\". If SNMP is being used, make sure the parameters are properly configured using either vCLI or PowerCLI, or using an API client.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.monitoring.doc_50/GUID-8EF36D7D-59B6-4C74-B1AA-4A9D18AB6250.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Disable Managed Object Browser (MOB)\r\n<ul>\r\n	<li>Title: disable-mob</li>\r\n	<li>Discussion: I can\'t put it any better than the VMware-provided description for this vulnerability already has. I\'ll quote it below directly from the Hardening Guidelines.\r\n<ul>\r\n	<li>\"The managed object browser (MOB) provides a way to explore the object model used by the VMkernel to manage the host; it enables configurations to be changed as well. This interface is meant to be used primarily for debugging the vSphere SDK but because there are no access controls it could also be used as a method obtain information about a host being targeted for unauthorized access. To determine if the MOB is enabled run the following command on the ESXi shell: \"vim-cmd proxysvc/service_list\". To disable the MOB run the following command: \"vim-cmd proxysvc/remove_service \"/mob\" \"httpsWithRedirect\"\". Note: You cannot disable MOB while in lockdown mode. The MOB will no longer be available for diagnostics. Some 3rd party tools use this interface to gather information. Testing should be done after disabling the MOB to verify 3rd party applications are still functioning as expected. To re-enable the MOB: ~ # vim-cmd proxysvc/add_np_service \"/mob\" httpsWithRedirect\"</li>\r\n</ul>\r\n</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/1016039\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: When adding ESXi hosts to Active Directory use the vSphere Authentication Proxy to protect passwords\r\n<ul>\r\n	<li>Title: enable-auth-proxy</li>\r\n	<li>Discussion: In environments that use both ESXi Autodeploy and Active Directory to manage hosts, the password used to join Active Directory is sent in cleartext to each host as it boots up, which puts that password at great risk of interception. Instead, VMware provides a vSphere Authentication Proxy to help keep this communication secure. Here are the <a href=\"http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.install.doc_50%2FGUID-EA920335-2608-4127-9B57-DB3809BA4BB9.html\">official deployment instructions</a>.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-084B74BD-40A5-4A4B-A82C-0C9912D580DC.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>\r\nWe\'ll pick this back up tomorrow and knock out another 5 ESXi hardening checks!','VSPHERE 5.0 HARDENING GUIDE DISCUSSION - PART 2','','inherit','open','open','','6914-revision-15','','','2012-06-26 04:13:34','2012-06-26 04:13:34','',6914,'http://egroup.jasonmangone.com/6914-revision-15',0,'revision','',0),(6937,24,'2012-06-27 01:29:06','2012-06-27 01:29:06','I ran into an issue today where What\'s Up Gold was showing interfaces down that were up in the switch.  In What\'s Up Gold each interface is referenced by an index number that is dynamically assigned by the IOS on startup.  The problems begin when a router or a switch are rebooted.  It dynamically assigns the interfaces an index number and it may or may not be the same as the index number before.\n\nTo fix this issue under global config mode type the command- Switch(config)# <strong>snmp-server ifindex persist</strong> then issue a <strong>copy run start</strong> to save the config.  Now the index table is saved with the running configuration and will keep the same index number during a reload.  ','SNMP-Server ifindex persist','','inherit','open','open','','6936-revision','','','2012-06-27 01:29:06','2012-06-27 01:29:06','',6936,'http://egroup.jasonmangone.com/6936-revision',0,'revision','',0),(6938,24,'2012-06-27 01:29:38','2012-06-27 01:29:38','I ran into an issue today where What\'s Up Gold was showing interfaces down that were up in the switch.  In What\'s Up Gold each interface is referenced by an index number that is dynamically assigned by the IOS on startup.  The problems begin when a router or a switch are rebooted.  It dynamically assigns the interfaces an index number and it may or may not be the same as the index number before.\r\n\r\nTo fix this issue under global config mode type the command- Switch(config)# <strong>snmp-server ifindex persist</strong> then issue a <strong>copy run start</strong> to save the config.  Now the index table is saved with the running configuration and will keep the same index number during a reload.  ','SNMP-Server ifindex persist','','inherit','open','open','','6936-revision-2','','','2012-06-27 01:29:38','2012-06-27 01:29:38','',6936,'http://egroup.jasonmangone.com/6936-revision-2',0,'revision','',0),(6939,24,'2012-06-27 01:31:56','2012-06-27 01:31:56','I ran into an issue today where What\'s Up Gold was showing interfaces down that were up in the switch.  In What\'s Up Gold each interface is referenced by an index number that is dynamically assigned by the IOS on startup.  The problems begin when a router or a switch are rebooted.  It dynamically assigns the interfaces an index number and it may or may not be the same as the index number before.\r\n\r\nTo fix this issue under global config mode type the command- Switch(config)# <strong>snmp-server ifindex persist</strong> then issue a <strong>copy run start</strong> to save the config.  Now the index table is saved with the running configuration and will keep the same index number during a reload.  ','SNMP-Server ifindex persist','','inherit','open','open','','6936-revision-3','','','2012-06-27 01:31:56','2012-06-27 01:31:56','',6936,'http://egroup.jasonmangone.com/6936-revision-3',0,'revision','',0),(6940,35,'2012-06-27 08:00:12','2012-06-27 08:00:12','If you\'re just joining us, I\'m blogging my way through the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a>. The preceding posts, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a> and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a>, are also available. Today\'s post discusses self-signed certificates, the DCUI console, and the memorable ESXi shell. Let\'s dive in!\r\n<ul>\r\n	<li>Guideline Title: Enable SSL for NFC\r\n<ul>\r\n	<li>Title: enable-nfc-ssl</li>\r\n	<li>Discussion: NFC (Network File Copy) is used to copy or migrate VMs between ESXi hosts. The vulnerability being addressed here is network traffic sniffing. If an attacker sniffed NFC traffic as it was being used to ship an entire VM, they would get an effective duplicate of your entire virtual server. Normally turning SSL on here would be an easy decision to recommend, but in this case, VMware\'s guidance on this issue is that NFC over SSL between ESXi hosts \"has ... not been extensively tested and so may cause HA and other operations to fail in certain circumstances.\" Ouch. We\'ll keep our eye on this one and hope that NFC over SSL gets more testing in the future. In the meantime, make sure your vSphere management networks and VLANs are sufficiently isolated as a partial mitigation.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/2010332\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title:  Do not use default self-signed certificates for ESXi communication\r\n<ul>\r\n	<li>Title: esxi-no-self-signed-certs</li>\r\n	<li>Discussion: This hardening guidance is written towards vSphere, but it\'s always good guidance for any system that uses encryption, even plain ol\' Windows Remote Desktop! Wikipedia has a <a href=\"http://en.wikipedia.org/wiki/Man-in-the-middle_attack\">detailed explanation of man-in-the-middle attacks</a>, but here\'s the gist: whenever you choose to connect to a server with an unverified SSL certificate, you have no certainty that your encrypted SSL tunnel reaches all the way to the server you\'re talking to. It\'s possible that your traffic is being intercepted, decrypted, stored, re-encrypted, and sent to its destination - all without you or the server you\'re connecting to being aware your traffic was intercepted. Self-signed SSL certs are generic and hard to distinguish from each other. They also lose the benefit of having a Certificate Authority confirm the validity of the cert. The solution is always replace default/vendor certificates on all network endpoints with certs issued by a commercial or organizational Certificate Authority.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.solutions.doc_50/GUID-37AAEDFE-EF2E-45FC-B0C6-44841E4FB302.html\">VMware Official documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Prevent unintended use of dvfilter network APIs\r\n<ul>\r\n	<li>Title: verify-dvfilter-bind</li>\r\n	<li>Discussion: The dvfilter network APIs are part of the larger <a href=\"http://blogs.vmware.com/vcloud/2010/04/what-actually-is-vmsafe-and-the-vmsafe-api.html\">VMsafe API</a> and they allow VMware partners to develop virtual security appliances to control the behavior of guest virtual machines. These virtual appliances have the benefit of simplifying guest VM configuration while increasing the overall security of your environment. Some great examples of this include <a href=\"http://www.trendmicro.com/us/enterprise/cloud-solutions/deep-security/index.html\">Trend Micro Deep Security</a>, the <a href=\"http://www.cisco.com/en/US/products/ps11208/index.html\">Cisco Virtual Security Gateway</a>, and the <a href=\"http://www.juniper.net/us/en/products-services/software/security/vgw-series/\">Juniper Virtual Gateway</a>. These appliances allow you to manage firewalls around your VMs as easily as dragging and dropping VMs in vCenter, enabling secure VM isolation (e.g. \"DEV servers can\'t talk to PROD servers\") but without sacrificing any ease of management (one of the reasons we virtualized everything in the first place, right?) These virtual security appliances using the dvfilter APIs receive privileged access to other guest VM network traffic. If you\'re not using any security appliances that leverage these APIs, you\'ll want to confirm they\'re not in use to prevent a malicious VM from receiving the data instead.</li>\r\n	<li>Official VMware documentation is still TBD</li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Disable DCUI to prevent local administrative control\r\n<ul>\r\n	<li>Title: disable-dcui</li>\r\n	<li>Discussion: <strong>NOTE: This is only recommended by VMware for the most secure environments. </strong>The DCUI is the name of the service that runs the gray and yellow console screen we all see when we first install ESXi and then promptly forget exists. This service can be stopped (and configured to not auto-start) which prevents any operations from occurring at the console or over a KVM. Be very careful and know the impact of this change. If you misconfigure a vSwitch and knock your host management kernel port offline, there\'s no parachute to reset the host vSwitch and you might be reaching for an ESXi install disk.</li>\r\n	<li>Official VMware documentation is still TBD</li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Disable ESXi Shell unless needed for diagnostics or troubleshooting\r\n<ul>\r\n	<li>Title: disable-esxi-shell</li>\r\n	<li>Discussion: This is known by some as the ESXi command line, formerly known as Tech Support Mode. From an ESXi console, you can press Alt+F1 and login as root to access a BusyBox environment that looks and acts a bit like Linux but has full control over host operations. The ESXi Shell should be started as necessary through the vSphere console for troubleshooting purposes and remain stopped the rest of the time.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/1017910\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 3','','publish','open','open','','vsphere-5-0-hardening-guide-discussion-part-3','','','2012-06-28 01:31:04','2012-06-28 01:31:04','',0,'http://egroup.jasonmangone.com/?p=6940',0,'post','',0),(6941,35,'2012-06-27 03:48:40','2012-06-27 03:48:40','If you\'re just joining us, I\'m blogging my way through the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a>. The preceding posts, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a> and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a>, are also available. Today\'s post discusses self-signed certificates, the DCUI console, and the memorable ESXi shell. Let\'s dive in!\n<ul>\n	<li>Guideline Title: Enable SSL for NFC</li>\n	<li>Title: enable-nfc-ssl</li>\n	<li>Discussion: NFC (Network File Copy) is used to copy or migrate VMs between ESXi hosts. The vulnerability being addressed here is network traffic sniffing. If an attacker sniffed NFC traffic as it was being used to ship an entire VM, they would get an effective duplicate of your entire virtual server. Normally turning SSL on here would be an easy decision to recommend, but in this case, VMware\'s guidance on this issue is that NFC over SSL between ESXi hosts \"has ... not been extensively tested and so may cause HA and other operations to fail in certain circumstances.\" Ouch. We\'ll keep our eye on this one and hope that NFC over SSL gets more testing in the future. In the meantime, make sure your vSphere management networks and VLANs are sufficiently isolated as a partial mitigation.</li>\n	<li><a href=\"http://kb.vmware.com/kb/2010332\">Official VMware documentation</a></li>\n	<li>Guideline Title:  Do not use default self-signed certificates for ESXi communication</li>\n	<li>Title: esxi-no-self-signed-certs</li>\n	<li>Discussion: This hardening guidance is written towards vSphere, but it\'s always good guidance for any system that uses encryption, even plain ol\' Windows Remote Desktop! Wikipedia has a <a href=\"http://en.wikipedia.org/wiki/Man-in-the-middle_attack\">detailed explanation of man-in-the-middle attacks</a>, but here\'s the gist: whenever you choose to connect to a server with an unverified SSL certificate, you have no certainty that your encrypted SSL tunnel reaches all the way to the server you\'re talking to. It\'s possible that your traffic is being intercepted, decrypted, stored, re-encrypted, and sent to its destination - all without you or the server you\'re connecting to being aware your traffic was intercepted. Self-signed SSL certs are generic and hard to distinguish from each other. They also lose the benefit of having a Certificate Authority confirm the validity of the cert. The solution is always replace default/vendor certificates on all network endpoints with certs issued by a commercial or organizational Certificate Authority.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.solutions.doc_50/GUID-37AAEDFE-EF2E-45FC-B0C6-44841E4FB302.html\">VMware Official documentation</a></li>\n	<li>Guideline Title: Prevent unintended use of dvfilter network APIs</li>\n	<li>Title: verify-dvfilter-bind</li>\n	<li>Discussion:\n\n\nIf you are not using products that make use of the dvfilter network API, the host should not be configured to send network information to a VM. If the API is enabled, an attacker might attempt to connect a VM to it, thereby potentially providing access to the network of other VMs on the host. If you are using a product that makes use o this API then verify that the host has been configured correctly. 1,2,3 Parameter If a dvfilter-based network security appliance is not being used on the host, ensure that the following kernel parameter has a blank value: /Net/DVFilterBindIpAddress. From the vSphere client select the host and click \"Configuration -&gt; Advanced Settings -&gt; Net\" and verify that Net.DVFilterBindIpAddress has an empty value. If such an appliance is being used, then make sure the value of this parameter is set to match this appliance. N/A Net.DVFilterBindIpAddress empty Modify Yes This will prevent a dvfilter-based network security appliance from functioning http://www.vmware.com/go/vmsafe/</li>\n	<li>disable-dcui vSphere 5.0 ESXI Console Disable DCUI to prevent local administrative control. NOTE: This is only recommended by VMware for the most secure environments.The DCUI allows for low-level host configuration such as configuring IP address, hostname and root password as well as diagnostic capabilities such as enabling the ESXi shell, viewing log files, restarting agents, and resetting configurations. Actions performed from the DCUI are not tracked by vCenter Server. Even if Lockdown Mode is enabled, someone with the root password can perform administrative tasks in the DCUI bypassing RBAC and auditing controls provided through vCenter. DCUI access can be disabled. Disabling it prevents all local activity and thus forces actions to be performed in vCenter Server where they can be centrally audited and monitored. 1 Parameter From the vSphere Client, select the host and select \"Configuration -&gt; Security Profile\". In the services section select “Properties\". Select \"Direct Console UI\" and click “Options”. From the pop-up stop the DCUI service and set the startup policy to \"start and stop manually\". DCUI access can also be configured using APIs and PowerCLI as well as with Host Profiles. N/A N/A Stopped Modify No TBD</li>\n	<li>disable-esxi-shell vSphere 5.0 ESXI Console Disable ESXi Shell unless needed for diagnostics or troubleshooting. ESXi Shell is an interactive command line environment available from the DCUI or remotely via SSH. Access to this mode requires the root password of the server. The ESXi Shell can be turned on and off for individual hosts. Activities performed from the ESXi Shell bypass vCenter RBAC and audit controls. The ESXi shell should only be turned on when needed to troubleshoot/resolve problems that cannot be fixed through the vSphere client or vCLI/PowerCLI. 1,2,3 Parameter From the DCUI: select \"Troubleshooting Options\" from the main menu and select \"Enable ESXi Shell\". From the vSphere Client, select the host then select \"Configuration -&gt; Security Profiles\". In the Services section select \"Properties\". Select the \"ESXi Shell\" and click Options. Stop the ESXi Shell and select the option to \"Start and stop manually\". Note: A host warning is displayed in the vSphere client when the ESXi Shell is enabled. N/A N/A Stopped Modify Yes http://kb.vmware.com/kb/1017910</li>\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 3','','inherit','open','open','','6940-revision','','','2012-06-27 03:48:40','2012-06-27 03:48:40','',6940,'http://egroup.jasonmangone.com/6940-revision',0,'revision','',0),(6943,35,'2012-06-27 04:01:40','2012-06-27 04:01:40','If you\'re just joining us, I\'m blogging my way through the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a>. The preceding posts, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a> and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a>, are also available. Today\'s post discusses self-signed certificates, the DCUI console, and the memorable ESXi shell. Let\'s dive in!\n<ul>\n	<li>Guideline Title: Enable SSL for NFC</li>\n	<li>Title: enable-nfc-ssl</li>\n	<li>Discussion: NFC (Network File Copy) is used to copy or migrate VMs between ESXi hosts. The vulnerability being addressed here is network traffic sniffing. If an attacker sniffed NFC traffic as it was being used to ship an entire VM, they would get an effective duplicate of your entire virtual server. Normally turning SSL on here would be an easy decision to recommend, but in this case, VMware\'s guidance on this issue is that NFC over SSL between ESXi hosts \"has ... not been extensively tested and so may cause HA and other operations to fail in certain circumstances.\" Ouch. We\'ll keep our eye on this one and hope that NFC over SSL gets more testing in the future. In the meantime, make sure your vSphere management networks and VLANs are sufficiently isolated as a partial mitigation.</li>\n	<li><a href=\"http://kb.vmware.com/kb/2010332\">Official VMware documentation</a></li>\n	<li>Guideline Title:  Do not use default self-signed certificates for ESXi communication</li>\n	<li>Title: esxi-no-self-signed-certs</li>\n	<li>Discussion: This hardening guidance is written towards vSphere, but it\'s always good guidance for any system that uses encryption, even plain ol\' Windows Remote Desktop! Wikipedia has a <a href=\"http://en.wikipedia.org/wiki/Man-in-the-middle_attack\">detailed explanation of man-in-the-middle attacks</a>, but here\'s the gist: whenever you choose to connect to a server with an unverified SSL certificate, you have no certainty that your encrypted SSL tunnel reaches all the way to the server you\'re talking to. It\'s possible that your traffic is being intercepted, decrypted, stored, re-encrypted, and sent to its destination - all without you or the server you\'re connecting to being aware your traffic was intercepted. Self-signed SSL certs are generic and hard to distinguish from each other. They also lose the benefit of having a Certificate Authority confirm the validity of the cert. The solution is always replace default/vendor certificates on all network endpoints with certs issued by a commercial or organizational Certificate Authority.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.solutions.doc_50/GUID-37AAEDFE-EF2E-45FC-B0C6-44841E4FB302.html\">VMware Official documentation</a></li>\n	<li>Guideline Title: Prevent unintended use of dvfilter network APIs</li>\n	<li>Title: verify-dvfilter-bind</li>\n	<li>Discussion: The dvfilter network APIs are part of the larger <a href=\"http://blogs.vmware.com/vcloud/2010/04/what-actually-is-vmsafe-and-the-vmsafe-api.html\">VMsafe API</a> and they allow VMware partners to develop virtual security appliances to control the behavior of guest virtual machines. These virtual appliances have the benefit of simplifying guest VM configuration while increasing the overall security of your environment. Some great examples of this include <a href=\"http://www.trendmicro.com/us/enterprise/cloud-solutions/deep-security/index.html\">Trend Micro Deep Security</a>, the <a href=\"http://www.cisco.com/en/US/products/ps11208/index.html\">Cisco Virtual Security Gateway</a>, and the <a href=\"http://www.juniper.net/us/en/products-services/software/security/vgw-series/\">Juniper Virtual Gateway</a>. These appliances allow you to manage firewalls around your VMs as easily as dragging and dropping VMs in vCenter, enabling secure VM isolation (e.g. \"DEV servers can\'t talk to PROD servers\") but without sacrificing any ease of management (one of the reasons we virtualized everything in the first place, right?) These virtual security appliances using the dvfilter APIs receive privileged access to other guest VM network traffic. If you\'re not using any security appliances that leverage these APIs, you\'ll want to confirm they\'re not in use to prevent a malicious VM from receiving the data instead.</li>\n	<li>No official http://www.vmware.com/go/vmsafe/</li>\n	<li>disable-dcui vSphere 5.0 ESXI Console Disable DCUI to prevent local administrative control. NOTE: This is only recommended by VMware for the most secure environments.The DCUI allows for low-level host configuration such as configuring IP address, hostname and root password as well as diagnostic capabilities such as enabling the ESXi shell, viewing log files, restarting agents, and resetting configurations. Actions performed from the DCUI are not tracked by vCenter Server. Even if Lockdown Mode is enabled, someone with the root password can perform administrative tasks in the DCUI bypassing RBAC and auditing controls provided through vCenter. DCUI access can be disabled. Disabling it prevents all local activity and thus forces actions to be performed in vCenter Server where they can be centrally audited and monitored. 1 Parameter From the vSphere Client, select the host and select \"Configuration -&gt; Security Profile\". In the services section select “Properties\". Select \"Direct Console UI\" and click “Options”. From the pop-up stop the DCUI service and set the startup policy to \"start and stop manually\". DCUI access can also be configured using APIs and PowerCLI as well as with Host Profiles. N/A N/A Stopped Modify No TBD</li>\n	<li>disable-esxi-shell vSphere 5.0 ESXI Console Disable ESXi Shell unless needed for diagnostics or troubleshooting. ESXi Shell is an interactive command line environment available from the DCUI or remotely via SSH. Access to this mode requires the root password of the server. The ESXi Shell can be turned on and off for individual hosts. Activities performed from the ESXi Shell bypass vCenter RBAC and audit controls. The ESXi shell should only be turned on when needed to troubleshoot/resolve problems that cannot be fixed through the vSphere client or vCLI/PowerCLI. 1,2,3 Parameter From the DCUI: select \"Troubleshooting Options\" from the main menu and select \"Enable ESXi Shell\". From the vSphere Client, select the host then select \"Configuration -&gt; Security Profiles\". In the Services section select \"Properties\". Select the \"ESXi Shell\" and click Options. Stop the ESXi Shell and select the option to \"Start and stop manually\". Note: A host warning is displayed in the vSphere client when the ESXi Shell is enabled. N/A N/A Stopped Modify Yes http://kb.vmware.com/kb/1017910</li>\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 3','','inherit','open','open','','6940-revision-3','','','2012-06-27 04:01:40','2012-06-27 04:01:40','',6940,'http://egroup.jasonmangone.com/6940-revision-3',0,'revision','',0),(6942,35,'2012-06-27 04:00:40','2012-06-27 04:00:40','If you\'re just joining us, I\'m blogging my way through the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a>. The preceding posts, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a> and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a>, are also available. Today\'s post discusses self-signed certificates, the DCUI console, and the memorable ESXi shell. Let\'s dive in!\n<ul>\n	<li>Guideline Title: Enable SSL for NFC</li>\n	<li>Title: enable-nfc-ssl</li>\n	<li>Discussion: NFC (Network File Copy) is used to copy or migrate VMs between ESXi hosts. The vulnerability being addressed here is network traffic sniffing. If an attacker sniffed NFC traffic as it was being used to ship an entire VM, they would get an effective duplicate of your entire virtual server. Normally turning SSL on here would be an easy decision to recommend, but in this case, VMware\'s guidance on this issue is that NFC over SSL between ESXi hosts \"has ... not been extensively tested and so may cause HA and other operations to fail in certain circumstances.\" Ouch. We\'ll keep our eye on this one and hope that NFC over SSL gets more testing in the future. In the meantime, make sure your vSphere management networks and VLANs are sufficiently isolated as a partial mitigation.</li>\n	<li><a href=\"http://kb.vmware.com/kb/2010332\">Official VMware documentation</a></li>\n	<li>Guideline Title:  Do not use default self-signed certificates for ESXi communication</li>\n	<li>Title: esxi-no-self-signed-certs</li>\n	<li>Discussion: This hardening guidance is written towards vSphere, but it\'s always good guidance for any system that uses encryption, even plain ol\' Windows Remote Desktop! Wikipedia has a <a href=\"http://en.wikipedia.org/wiki/Man-in-the-middle_attack\">detailed explanation of man-in-the-middle attacks</a>, but here\'s the gist: whenever you choose to connect to a server with an unverified SSL certificate, you have no certainty that your encrypted SSL tunnel reaches all the way to the server you\'re talking to. It\'s possible that your traffic is being intercepted, decrypted, stored, re-encrypted, and sent to its destination - all without you or the server you\'re connecting to being aware your traffic was intercepted. Self-signed SSL certs are generic and hard to distinguish from each other. They also lose the benefit of having a Certificate Authority confirm the validity of the cert. The solution is always replace default/vendor certificates on all network endpoints with certs issued by a commercial or organizational Certificate Authority.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.solutions.doc_50/GUID-37AAEDFE-EF2E-45FC-B0C6-44841E4FB302.html\">VMware Official documentation</a></li>\n	<li>Guideline Title: Prevent unintended use of dvfilter network APIs</li>\n	<li>Title: verify-dvfilter-bind</li>\n	<li>Discussion: The dvfilter network APIs are part of the larger <a href=\"http://blogs.vmware.com/vcloud/2010/04/what-actually-is-vmsafe-and-the-vmsafe-api.html\">VMsafe API</a> and they allow VMware partners to develop virtual security appliances to control the behavior of guest virtual machines. These virtual appliances have the benefit of simplifying guest VM configuration while increasing the overall security of your environment. Some great examples of this include <a href=\"http://www.trendmicro.com/us/enterprise/cloud-solutions/deep-security/index.html\">Trend Micro Deep Security</a>, the <a href=\"http://www.cisco.com/en/US/products/ps11208/index.html\">Cisco Virtual Security Gateway</a>, and the <a href=\"http://www.juniper.net/us/en/products-services/software/security/vgw-series/\">Juniper Virtual Gateway</a>. These appliances allow you to manage firewalls around your VMs as easily as dragging and dropping VMs in vCenter, enabling secure VM isolation (e.g. \"DEV servers can\'t talk to PROD servers\") but without sacrificing any ease of management (one of the reasons we virtualized everything in the first place, right?) These virtual security appliances using the dvfilter APIs receive privileged access to other guest VM network traffic. If you\'re not using any security appliances that leverage these APIs, you\'ll want to confirm\n\n\nIf you are not using products that make use of the dvfilter network API, the host should not be configured to send network information to a VM. If the API is enabled, an attacker might attempt to connect a VM to it, thereby potentially providing access to the network of other VMs on the host. If you are using a product that makes use o this API then verify that the host has been configured correctly. 1,2,3 Parameter If a dvfilter-based network security appliance is not being used on the host, ensure that the following kernel parameter has a blank value: /Net/DVFilterBindIpAddress. From the vSphere client select the host and click \"Configuration -&gt; Advanced Settings -&gt; Net\" and verify that Net.DVFilterBindIpAddress has an empty value. If such an appliance is being used, then make sure the value of this parameter is set to match this appliance. N/A Net.DVFilterBindIpAddress empty Modify Yes This will prevent a dvfilter-based network security appliance from functioning http://www.vmware.com/go/vmsafe/</li>\n	<li>disable-dcui vSphere 5.0 ESXI Console Disable DCUI to prevent local administrative control. NOTE: This is only recommended by VMware for the most secure environments.The DCUI allows for low-level host configuration such as configuring IP address, hostname and root password as well as diagnostic capabilities such as enabling the ESXi shell, viewing log files, restarting agents, and resetting configurations. Actions performed from the DCUI are not tracked by vCenter Server. Even if Lockdown Mode is enabled, someone with the root password can perform administrative tasks in the DCUI bypassing RBAC and auditing controls provided through vCenter. DCUI access can be disabled. Disabling it prevents all local activity and thus forces actions to be performed in vCenter Server where they can be centrally audited and monitored. 1 Parameter From the vSphere Client, select the host and select \"Configuration -&gt; Security Profile\". In the services section select “Properties\". Select \"Direct Console UI\" and click “Options”. From the pop-up stop the DCUI service and set the startup policy to \"start and stop manually\". DCUI access can also be configured using APIs and PowerCLI as well as with Host Profiles. N/A N/A Stopped Modify No TBD</li>\n	<li>disable-esxi-shell vSphere 5.0 ESXI Console Disable ESXi Shell unless needed for diagnostics or troubleshooting. ESXi Shell is an interactive command line environment available from the DCUI or remotely via SSH. Access to this mode requires the root password of the server. The ESXi Shell can be turned on and off for individual hosts. Activities performed from the ESXi Shell bypass vCenter RBAC and audit controls. The ESXi shell should only be turned on when needed to troubleshoot/resolve problems that cannot be fixed through the vSphere client or vCLI/PowerCLI. 1,2,3 Parameter From the DCUI: select \"Troubleshooting Options\" from the main menu and select \"Enable ESXi Shell\". From the vSphere Client, select the host then select \"Configuration -&gt; Security Profiles\". In the Services section select \"Properties\". Select the \"ESXi Shell\" and click Options. Stop the ESXi Shell and select the option to \"Start and stop manually\". Note: A host warning is displayed in the vSphere client when the ESXi Shell is enabled. N/A N/A Stopped Modify Yes http://kb.vmware.com/kb/1017910</li>\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 3','','inherit','open','open','','6940-revision-2','','','2012-06-27 04:00:40','2012-06-27 04:00:40','',6940,'http://egroup.jasonmangone.com/6940-revision-2',0,'revision','',0),(6944,35,'2012-06-27 04:05:23','2012-06-27 04:05:23','If you\'re just joining us, I\'m blogging my way through the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a>. The preceding posts, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a> and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a>, are also available. Today\'s post discusses self-signed certificates, the DCUI console, and the memorable ESXi shell. Let\'s dive in!\n<ul>\n	<li>Guideline Title: Enable SSL for NFC\n<ul>\n	<li>Title: enable-nfc-ssl</li>\n	<li>Discussion: NFC (Network File Copy) is used to copy or migrate VMs between ESXi hosts. The vulnerability being addressed here is network traffic sniffing. If an attacker sniffed NFC traffic as it was being used to ship an entire VM, they would get an effective duplicate of your entire virtual server. Normally turning SSL on here would be an easy decision to recommend, but in this case, VMware\'s guidance on this issue is that NFC over SSL between ESXi hosts \"has ... not been extensively tested and so may cause HA and other operations to fail in certain circumstances.\" Ouch. We\'ll keep our eye on this one and hope that NFC over SSL gets more testing in the future. In the meantime, make sure your vSphere management networks and VLANs are sufficiently isolated as a partial mitigation.</li>\n	<li><a href=\"http://kb.vmware.com/kb/2010332\">Official VMware documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title:  Do not use default self-signed certificates for ESXi communication\n<ul>\n	<li>Title: esxi-no-self-signed-certs</li>\n	<li>Discussion: This hardening guidance is written towards vSphere, but it\'s always good guidance for any system that uses encryption, even plain ol\' Windows Remote Desktop! Wikipedia has a <a href=\"http://en.wikipedia.org/wiki/Man-in-the-middle_attack\">detailed explanation of man-in-the-middle attacks</a>, but here\'s the gist: whenever you choose to connect to a server with an unverified SSL certificate, you have no certainty that your encrypted SSL tunnel reaches all the way to the server you\'re talking to. It\'s possible that your traffic is being intercepted, decrypted, stored, re-encrypted, and sent to its destination - all without you or the server you\'re connecting to being aware your traffic was intercepted. Self-signed SSL certs are generic and hard to distinguish from each other. They also lose the benefit of having a Certificate Authority confirm the validity of the cert. The solution is always replace default/vendor certificates on all network endpoints with certs issued by a commercial or organizational Certificate Authority.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.solutions.doc_50/GUID-37AAEDFE-EF2E-45FC-B0C6-44841E4FB302.html\">VMware Official documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title: Prevent unintended use of dvfilter network APIs\n<ul>\n	<li>Title: verify-dvfilter-bind</li>\n	<li>Discussion: The dvfilter network APIs are part of the larger <a href=\"http://blogs.vmware.com/vcloud/2010/04/what-actually-is-vmsafe-and-the-vmsafe-api.html\">VMsafe API</a> and they allow VMware partners to develop virtual security appliances to control the behavior of guest virtual machines. These virtual appliances have the benefit of simplifying guest VM configuration while increasing the overall security of your environment. Some great examples of this include <a href=\"http://www.trendmicro.com/us/enterprise/cloud-solutions/deep-security/index.html\">Trend Micro Deep Security</a>, the <a href=\"http://www.cisco.com/en/US/products/ps11208/index.html\">Cisco Virtual Security Gateway</a>, and the <a href=\"http://www.juniper.net/us/en/products-services/software/security/vgw-series/\">Juniper Virtual Gateway</a>. These appliances allow you to manage firewalls around your VMs as easily as dragging and dropping VMs in vCenter, enabling secure VM isolation (e.g. \"DEV servers can\'t talk to PROD servers\") but without sacrificing any ease of management (one of the reasons we virtualized everything in the first place, right?) These virtual security appliances using the dvfilter APIs receive privileged access to other guest VM network traffic. If you\'re not using any security appliances that leverage these APIs, you\'ll want to confirm they\'re not in use to prevent a malicious VM from receiving the data instead.</li>\n	<li>No official http://www.vmware.com/go/vmsafe/</li>\n</ul>\n</li>\n	<li>Guideline Title: Disable DCUI to prevent local administrative control</li>\n	<li>Title: disable-dcui</li>\n	<li>Discussion: NOTE: This is only recommended by VMware for the most secure environments.The DCUI is the name of the service that runs the gray and yellow console screen we all see when we first install ESXi and then promptly forget exists. This service c\n\n\nallows for low-level host configuration such as configuring IP address, hostname and root password as well as diagnostic capabilities such as enabling the ESXi shell, viewing log files, restarting agents, and resetting configurations. Actions performed from the DCUI are not tracked by vCenter Server. Even if Lockdown Mode is enabled, someone with the root password can perform administrative tasks in the DCUI bypassing RBAC and auditing controls provided through vCenter. DCUI access can be disabled. Disabling it prevents all local activity and thus forces actions to be performed in vCenter Server where they can be centrally audited and monitored. 1 Parameter From the vSphere Client, select the host and select \"Configuration -&gt; Security Profile\". In the services section select “Properties\". Select \"Direct Console UI\" and click “Options”. From the pop-up stop the DCUI service and set the startup policy to \"start and stop manually\". DCUI access can also be configured using APIs and PowerCLI as well as with Host Profiles. N/A N/A Stopped Modify No TBD</li>\n	<li>disable-esxi-shell vSphere 5.0 ESXI Console Disable ESXi Shell unless needed for diagnostics or troubleshooting. ESXi Shell is an interactive command line environment available from the DCUI or remotely via SSH. Access to this mode requires the root password of the server. The ESXi Shell can be turned on and off for individual hosts. Activities performed from the ESXi Shell bypass vCenter RBAC and audit controls. The ESXi shell should only be turned on when needed to troubleshoot/resolve problems that cannot be fixed through the vSphere client or vCLI/PowerCLI. 1,2,3 Parameter From the DCUI: select \"Troubleshooting Options\" from the main menu and select \"Enable ESXi Shell\". From the vSphere Client, select the host then select \"Configuration -&gt; Security Profiles\". In the Services section select \"Properties\". Select the \"ESXi Shell\" and click Options. Stop the ESXi Shell and select the option to \"Start and stop manually\". Note: A host warning is displayed in the vSphere client when the ESXi Shell is enabled. N/A N/A Stopped Modify Yes http://kb.vmware.com/kb/1017910</li>\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 3','','inherit','open','open','','6940-revision-4','','','2012-06-27 04:05:23','2012-06-27 04:05:23','',6940,'http://egroup.jasonmangone.com/6940-revision-4',0,'revision','',0),(6945,35,'2012-06-27 04:06:23','2012-06-27 04:06:23','If you\'re just joining us, I\'m blogging my way through the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a>. The preceding posts, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a> and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a>, are also available. Today\'s post discusses self-signed certificates, the DCUI console, and the memorable ESXi shell. Let\'s dive in!\n<ul>\n	<li>Guideline Title: Enable SSL for NFC\n<ul>\n	<li>Title: enable-nfc-ssl</li>\n	<li>Discussion: NFC (Network File Copy) is used to copy or migrate VMs between ESXi hosts. The vulnerability being addressed here is network traffic sniffing. If an attacker sniffed NFC traffic as it was being used to ship an entire VM, they would get an effective duplicate of your entire virtual server. Normally turning SSL on here would be an easy decision to recommend, but in this case, VMware\'s guidance on this issue is that NFC over SSL between ESXi hosts \"has ... not been extensively tested and so may cause HA and other operations to fail in certain circumstances.\" Ouch. We\'ll keep our eye on this one and hope that NFC over SSL gets more testing in the future. In the meantime, make sure your vSphere management networks and VLANs are sufficiently isolated as a partial mitigation.</li>\n	<li><a href=\"http://kb.vmware.com/kb/2010332\">Official VMware documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title:  Do not use default self-signed certificates for ESXi communication\n<ul>\n	<li>Title: esxi-no-self-signed-certs</li>\n	<li>Discussion: This hardening guidance is written towards vSphere, but it\'s always good guidance for any system that uses encryption, even plain ol\' Windows Remote Desktop! Wikipedia has a <a href=\"http://en.wikipedia.org/wiki/Man-in-the-middle_attack\">detailed explanation of man-in-the-middle attacks</a>, but here\'s the gist: whenever you choose to connect to a server with an unverified SSL certificate, you have no certainty that your encrypted SSL tunnel reaches all the way to the server you\'re talking to. It\'s possible that your traffic is being intercepted, decrypted, stored, re-encrypted, and sent to its destination - all without you or the server you\'re connecting to being aware your traffic was intercepted. Self-signed SSL certs are generic and hard to distinguish from each other. They also lose the benefit of having a Certificate Authority confirm the validity of the cert. The solution is always replace default/vendor certificates on all network endpoints with certs issued by a commercial or organizational Certificate Authority.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.solutions.doc_50/GUID-37AAEDFE-EF2E-45FC-B0C6-44841E4FB302.html\">VMware Official documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title: Prevent unintended use of dvfilter network APIs\n<ul>\n	<li>Title: verify-dvfilter-bind</li>\n	<li>Discussion: The dvfilter network APIs are part of the larger <a href=\"http://blogs.vmware.com/vcloud/2010/04/what-actually-is-vmsafe-and-the-vmsafe-api.html\">VMsafe API</a> and they allow VMware partners to develop virtual security appliances to control the behavior of guest virtual machines. These virtual appliances have the benefit of simplifying guest VM configuration while increasing the overall security of your environment. Some great examples of this include <a href=\"http://www.trendmicro.com/us/enterprise/cloud-solutions/deep-security/index.html\">Trend Micro Deep Security</a>, the <a href=\"http://www.cisco.com/en/US/products/ps11208/index.html\">Cisco Virtual Security Gateway</a>, and the <a href=\"http://www.juniper.net/us/en/products-services/software/security/vgw-series/\">Juniper Virtual Gateway</a>. These appliances allow you to manage firewalls around your VMs as easily as dragging and dropping VMs in vCenter, enabling secure VM isolation (e.g. \"DEV servers can\'t talk to PROD servers\") but without sacrificing any ease of management (one of the reasons we virtualized everything in the first place, right?) These virtual security appliances using the dvfilter APIs receive privileged access to other guest VM network traffic. If you\'re not using any security appliances that leverage these APIs, you\'ll want to confirm they\'re not in use to prevent a malicious VM from receiving the data instead.</li>\n	<li>No official http://www.vmware.com/go/vmsafe/</li>\n</ul>\n</li>\n	<li>Guideline Title: Disable DCUI to prevent local administrative control</li>\n	<li>Title: disable-dcui</li>\n	<li>Discussion: <strong>NOTE: This is only recommended by VMware for the most secure environments. </strong>The DCUI is the name of the service that runs the gray and yellow console screen we all see when we first install ESXi and then promptly forget exists. This service can be stopped which prevents any operations from occurring at the console or over a KVM.\n\n\nallows for low-level host configuration such as configuring IP address, hostname and root password as well as diagnostic capabilities such as enabling the ESXi shell, viewing log files, restarting agents, and resetting configurations. Actions performed from the DCUI are not tracked by vCenter Server. Even if Lockdown Mode is enabled, someone with the root password can perform administrative tasks in the DCUI bypassing RBAC and auditing controls provided through vCenter. DCUI access can be disabled. Disabling it prevents all local activity and thus forces actions to be performed in vCenter Server where they can be centrally audited and monitored. 1 Parameter From the vSphere Client, select the host and select \"Configuration -&gt; Security Profile\". In the services section select “Properties\". Select \"Direct Console UI\" and click “Options”. From the pop-up stop the DCUI service and set the startup policy to \"start and stop manually\". DCUI access can also be configured using APIs and PowerCLI as well as with Host Profiles. N/A N/A Stopped Modify No TBD</li>\n	<li>disable-esxi-shell vSphere 5.0 ESXI Console Disable ESXi Shell unless needed for diagnostics or troubleshooting. ESXi Shell is an interactive command line environment available from the DCUI or remotely via SSH. Access to this mode requires the root password of the server. The ESXi Shell can be turned on and off for individual hosts. Activities performed from the ESXi Shell bypass vCenter RBAC and audit controls. The ESXi shell should only be turned on when needed to troubleshoot/resolve problems that cannot be fixed through the vSphere client or vCLI/PowerCLI. 1,2,3 Parameter From the DCUI: select \"Troubleshooting Options\" from the main menu and select \"Enable ESXi Shell\". From the vSphere Client, select the host then select \"Configuration -&gt; Security Profiles\". In the Services section select \"Properties\". Select the \"ESXi Shell\" and click Options. Stop the ESXi Shell and select the option to \"Start and stop manually\". Note: A host warning is displayed in the vSphere client when the ESXi Shell is enabled. N/A N/A Stopped Modify Yes http://kb.vmware.com/kb/1017910</li>\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 3','','inherit','open','open','','6940-revision-5','','','2012-06-27 04:06:23','2012-06-27 04:06:23','',6940,'http://egroup.jasonmangone.com/6940-revision-5',0,'revision','',0),(6947,35,'2012-06-27 04:20:54','2012-06-27 04:20:54','If you\'re just joining us, I\'m blogging my way through the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a>. The preceding posts, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a> and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a>, are also available. Today\'s post discusses self-signed certificates, the DCUI console, and the memorable ESXi shell. Let\'s dive in!\r\n<ul>\r\n	<li>Guideline Title: Enable SSL for NFC\r\n<ul>\r\n	<li>Title: enable-nfc-ssl</li>\r\n	<li>Discussion: NFC (Network File Copy) is used to copy or migrate VMs between ESXi hosts. The vulnerability being addressed here is network traffic sniffing. If an attacker sniffed NFC traffic as it was being used to ship an entire VM, they would get an effective duplicate of your entire virtual server. Normally turning SSL on here would be an easy decision to recommend, but in this case, VMware\'s guidance on this issue is that NFC over SSL between ESXi hosts \"has ... not been extensively tested and so may cause HA and other operations to fail in certain circumstances.\" Ouch. We\'ll keep our eye on this one and hope that NFC over SSL gets more testing in the future. In the meantime, make sure your vSphere management networks and VLANs are sufficiently isolated as a partial mitigation.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/2010332\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title:  Do not use default self-signed certificates for ESXi communication\r\n<ul>\r\n	<li>Title: esxi-no-self-signed-certs</li>\r\n	<li>Discussion: This hardening guidance is written towards vSphere, but it\'s always good guidance for any system that uses encryption, even plain ol\' Windows Remote Desktop! Wikipedia has a <a href=\"http://en.wikipedia.org/wiki/Man-in-the-middle_attack\">detailed explanation of man-in-the-middle attacks</a>, but here\'s the gist: whenever you choose to connect to a server with an unverified SSL certificate, you have no certainty that your encrypted SSL tunnel reaches all the way to the server you\'re talking to. It\'s possible that your traffic is being intercepted, decrypted, stored, re-encrypted, and sent to its destination - all without you or the server you\'re connecting to being aware your traffic was intercepted. Self-signed SSL certs are generic and hard to distinguish from each other. They also lose the benefit of having a Certificate Authority confirm the validity of the cert. The solution is always replace default/vendor certificates on all network endpoints with certs issued by a commercial or organizational Certificate Authority.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.solutions.doc_50/GUID-37AAEDFE-EF2E-45FC-B0C6-44841E4FB302.html\">VMware Official documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Prevent unintended use of dvfilter network APIs\r\n<ul>\r\n	<li>Title: verify-dvfilter-bind</li>\r\n	<li>Discussion: The dvfilter network APIs are part of the larger <a href=\"http://blogs.vmware.com/vcloud/2010/04/what-actually-is-vmsafe-and-the-vmsafe-api.html\">VMsafe API</a> and they allow VMware partners to develop virtual security appliances to control the behavior of guest virtual machines. These virtual appliances have the benefit of simplifying guest VM configuration while increasing the overall security of your environment. Some great examples of this include <a href=\"http://www.trendmicro.com/us/enterprise/cloud-solutions/deep-security/index.html\">Trend Micro Deep Security</a>, the <a href=\"http://www.cisco.com/en/US/products/ps11208/index.html\">Cisco Virtual Security Gateway</a>, and the <a href=\"http://www.juniper.net/us/en/products-services/software/security/vgw-series/\">Juniper Virtual Gateway</a>. These appliances allow you to manage firewalls around your VMs as easily as dragging and dropping VMs in vCenter, enabling secure VM isolation (e.g. \"DEV servers can\'t talk to PROD servers\") but without sacrificing any ease of management (one of the reasons we virtualized everything in the first place, right?) These virtual security appliances using the dvfilter APIs receive privileged access to other guest VM network traffic. If you\'re not using any security appliances that leverage these APIs, you\'ll want to confirm they\'re not in use to prevent a malicious VM from receiving the data instead.</li>\r\n	<li>Official VMware documentation is still TBD</li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Disable DCUI to prevent local administrative control\r\n<ul>\r\n	<li>Title: disable-dcui</li>\r\n	<li>Discussion: <strong>NOTE: This is only recommended by VMware for the most secure environments. </strong>The DCUI is the name of the service that runs the gray and yellow console screen we all see when we first install ESXi and then promptly forget exists. This service can be stopped (and configured to not auto-start) which prevents any operations from occurring at the console or over a KVM. Be very careful and know the impact of this change. If you misconfigure a vSwitch and knock your host management kernel port offline, there\'s no parachute to reset the host vSwitch and you might be reaching for an ESXi install disk.</li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Disable ESXi Shell unless needed for diagnostics or troubleshooting\r\n<ul>\r\n	<li>Title: disable-esxi-shell</li>\r\n	<li>Discussion: This is known by some as the ESXi command line, formerly known as Tech Support Mode. From an ESXi console, you can press Alt+F1 and login as root to access a BusyBox environment that looks and acts a bit like Linux but has full control over host operations. The ESXi Shell should be started as necessary through the vSphere console for troubleshooting purposes and remain stopped the rest of the time.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/1017910\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 3','','inherit','open','open','','6940-revision-7','','','2012-06-27 04:20:54','2012-06-27 04:20:54','',6940,'http://egroup.jasonmangone.com/6940-revision-7',0,'revision','',0),(6946,35,'2012-06-27 04:07:23','2012-06-27 04:07:23','If you\'re just joining us, I\'m blogging my way through the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a>. The preceding posts, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a> and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a>, are also available. Today\'s post discusses self-signed certificates, the DCUI console, and the memorable ESXi shell. Let\'s dive in!\n<ul>\n	<li>Guideline Title: Enable SSL for NFC\n<ul>\n	<li>Title: enable-nfc-ssl</li>\n	<li>Discussion: NFC (Network File Copy) is used to copy or migrate VMs between ESXi hosts. The vulnerability being addressed here is network traffic sniffing. If an attacker sniffed NFC traffic as it was being used to ship an entire VM, they would get an effective duplicate of your entire virtual server. Normally turning SSL on here would be an easy decision to recommend, but in this case, VMware\'s guidance on this issue is that NFC over SSL between ESXi hosts \"has ... not been extensively tested and so may cause HA and other operations to fail in certain circumstances.\" Ouch. We\'ll keep our eye on this one and hope that NFC over SSL gets more testing in the future. In the meantime, make sure your vSphere management networks and VLANs are sufficiently isolated as a partial mitigation.</li>\n	<li><a href=\"http://kb.vmware.com/kb/2010332\">Official VMware documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title:  Do not use default self-signed certificates for ESXi communication\n<ul>\n	<li>Title: esxi-no-self-signed-certs</li>\n	<li>Discussion: This hardening guidance is written towards vSphere, but it\'s always good guidance for any system that uses encryption, even plain ol\' Windows Remote Desktop! Wikipedia has a <a href=\"http://en.wikipedia.org/wiki/Man-in-the-middle_attack\">detailed explanation of man-in-the-middle attacks</a>, but here\'s the gist: whenever you choose to connect to a server with an unverified SSL certificate, you have no certainty that your encrypted SSL tunnel reaches all the way to the server you\'re talking to. It\'s possible that your traffic is being intercepted, decrypted, stored, re-encrypted, and sent to its destination - all without you or the server you\'re connecting to being aware your traffic was intercepted. Self-signed SSL certs are generic and hard to distinguish from each other. They also lose the benefit of having a Certificate Authority confirm the validity of the cert. The solution is always replace default/vendor certificates on all network endpoints with certs issued by a commercial or organizational Certificate Authority.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.solutions.doc_50/GUID-37AAEDFE-EF2E-45FC-B0C6-44841E4FB302.html\">VMware Official documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title: Prevent unintended use of dvfilter network APIs\n<ul>\n	<li>Title: verify-dvfilter-bind</li>\n	<li>Discussion: The dvfilter network APIs are part of the larger <a href=\"http://blogs.vmware.com/vcloud/2010/04/what-actually-is-vmsafe-and-the-vmsafe-api.html\">VMsafe API</a> and they allow VMware partners to develop virtual security appliances to control the behavior of guest virtual machines. These virtual appliances have the benefit of simplifying guest VM configuration while increasing the overall security of your environment. Some great examples of this include <a href=\"http://www.trendmicro.com/us/enterprise/cloud-solutions/deep-security/index.html\">Trend Micro Deep Security</a>, the <a href=\"http://www.cisco.com/en/US/products/ps11208/index.html\">Cisco Virtual Security Gateway</a>, and the <a href=\"http://www.juniper.net/us/en/products-services/software/security/vgw-series/\">Juniper Virtual Gateway</a>. These appliances allow you to manage firewalls around your VMs as easily as dragging and dropping VMs in vCenter, enabling secure VM isolation (e.g. \"DEV servers can\'t talk to PROD servers\") but without sacrificing any ease of management (one of the reasons we virtualized everything in the first place, right?) These virtual security appliances using the dvfilter APIs receive privileged access to other guest VM network traffic. If you\'re not using any security appliances that leverage these APIs, you\'ll want to confirm they\'re not in use to prevent a malicious VM from receiving the data instead.</li>\n	<li>No official http://www.vmware.com/go/vmsafe/</li>\n</ul>\n</li>\n	<li>Guideline Title: Disable DCUI to prevent local administrative control</li>\n	<li>Title: disable-dcui</li>\n	<li>Discussion: <strong>NOTE: This is only recommended by VMware for the most secure environments. </strong>The DCUI is the name of the service that runs the gray and yellow console screen we all see when we first install ESXi and then promptly forget exists. This service can be stopped (and configured to not auto-start) which prevents any operations from occurring at the console or over a KVM.\n\n\nallows for low-level host configuration such as configuring IP address, hostname and root password as well as diagnostic capabilities such as enabling the ESXi shell, viewing log files, restarting agents, and resetting configurations. Actions performed from the DCUI are not tracked by vCenter Server. Even if Lockdown Mode is enabled, someone with the root password can perform administrative tasks in the DCUI bypassing RBAC and auditing controls provided through vCenter. DCUI access can be disabled. Disabling it prevents all local activity and thus forces actions to be performed in vCenter Server where they can be centrally audited and monitored. 1 Parameter From the vSphere Client, select the host and select \"Configuration -&gt; Security Profile\". In the services section select “Properties\". Select \"Direct Console UI\" and click “Options”. From the pop-up stop the DCUI service and set the startup policy to \"start and stop manually\". DCUI access can also be configured using APIs and PowerCLI as well as with Host Profiles. N/A N/A Stopped Modify No TBD</li>\n	<li>disable-esxi-shell vSphere 5.0 ESXI Console Disable ESXi Shell unless needed for diagnostics or troubleshooting. ESXi Shell is an interactive command line environment available from the DCUI or remotely via SSH. Access to this mode requires the root password of the server. The ESXi Shell can be turned on and off for individual hosts. Activities performed from the ESXi Shell bypass vCenter RBAC and audit controls. The ESXi shell should only be turned on when needed to troubleshoot/resolve problems that cannot be fixed through the vSphere client or vCLI/PowerCLI. 1,2,3 Parameter From the DCUI: select \"Troubleshooting Options\" from the main menu and select \"Enable ESXi Shell\". From the vSphere Client, select the host then select \"Configuration -&gt; Security Profiles\". In the Services section select \"Properties\". Select the \"ESXi Shell\" and click Options. Stop the ESXi Shell and select the option to \"Start and stop manually\". Note: A host warning is displayed in the vSphere client when the ESXi Shell is enabled. N/A N/A Stopped Modify Yes http://kb.vmware.com/kb/1017910</li>\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 3','','inherit','open','open','','6940-revision-6','','','2012-06-27 04:07:23','2012-06-27 04:07:23','',6940,'http://egroup.jasonmangone.com/6940-revision-6',0,'revision','',0),(6948,35,'2012-06-27 04:20:58','2012-06-27 04:20:58','If you\'re just joining us, I\'m blogging my way through the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a>. The preceding posts, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a> and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a>, are also available. Today\'s post discusses self-signed certificates, the DCUI console, and the memorable ESXi shell. Let\'s dive in!\r\n<ul>\r\n	<li>Guideline Title: Enable SSL for NFC\r\n<ul>\r\n	<li>Title: enable-nfc-ssl</li>\r\n	<li>Discussion: NFC (Network File Copy) is used to copy or migrate VMs between ESXi hosts. The vulnerability being addressed here is network traffic sniffing. If an attacker sniffed NFC traffic as it was being used to ship an entire VM, they would get an effective duplicate of your entire virtual server. Normally turning SSL on here would be an easy decision to recommend, but in this case, VMware\'s guidance on this issue is that NFC over SSL between ESXi hosts \"has ... not been extensively tested and so may cause HA and other operations to fail in certain circumstances.\" Ouch. We\'ll keep our eye on this one and hope that NFC over SSL gets more testing in the future. In the meantime, make sure your vSphere management networks and VLANs are sufficiently isolated as a partial mitigation.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/2010332\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title:  Do not use default self-signed certificates for ESXi communication\r\n<ul>\r\n	<li>Title: esxi-no-self-signed-certs</li>\r\n	<li>Discussion: This hardening guidance is written towards vSphere, but it\'s always good guidance for any system that uses encryption, even plain ol\' Windows Remote Desktop! Wikipedia has a <a href=\"http://en.wikipedia.org/wiki/Man-in-the-middle_attack\">detailed explanation of man-in-the-middle attacks</a>, but here\'s the gist: whenever you choose to connect to a server with an unverified SSL certificate, you have no certainty that your encrypted SSL tunnel reaches all the way to the server you\'re talking to. It\'s possible that your traffic is being intercepted, decrypted, stored, re-encrypted, and sent to its destination - all without you or the server you\'re connecting to being aware your traffic was intercepted. Self-signed SSL certs are generic and hard to distinguish from each other. They also lose the benefit of having a Certificate Authority confirm the validity of the cert. The solution is always replace default/vendor certificates on all network endpoints with certs issued by a commercial or organizational Certificate Authority.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.solutions.doc_50/GUID-37AAEDFE-EF2E-45FC-B0C6-44841E4FB302.html\">VMware Official documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Prevent unintended use of dvfilter network APIs\r\n<ul>\r\n	<li>Title: verify-dvfilter-bind</li>\r\n	<li>Discussion: The dvfilter network APIs are part of the larger <a href=\"http://blogs.vmware.com/vcloud/2010/04/what-actually-is-vmsafe-and-the-vmsafe-api.html\">VMsafe API</a> and they allow VMware partners to develop virtual security appliances to control the behavior of guest virtual machines. These virtual appliances have the benefit of simplifying guest VM configuration while increasing the overall security of your environment. Some great examples of this include <a href=\"http://www.trendmicro.com/us/enterprise/cloud-solutions/deep-security/index.html\">Trend Micro Deep Security</a>, the <a href=\"http://www.cisco.com/en/US/products/ps11208/index.html\">Cisco Virtual Security Gateway</a>, and the <a href=\"http://www.juniper.net/us/en/products-services/software/security/vgw-series/\">Juniper Virtual Gateway</a>. These appliances allow you to manage firewalls around your VMs as easily as dragging and dropping VMs in vCenter, enabling secure VM isolation (e.g. \"DEV servers can\'t talk to PROD servers\") but without sacrificing any ease of management (one of the reasons we virtualized everything in the first place, right?) These virtual security appliances using the dvfilter APIs receive privileged access to other guest VM network traffic. If you\'re not using any security appliances that leverage these APIs, you\'ll want to confirm they\'re not in use to prevent a malicious VM from receiving the data instead.</li>\r\n	<li>Official VMware documentation is still TBD</li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Disable DCUI to prevent local administrative control\r\n<ul>\r\n	<li>Title: disable-dcui</li>\r\n	<li>Discussion: <strong>NOTE: This is only recommended by VMware for the most secure environments. </strong>The DCUI is the name of the service that runs the gray and yellow console screen we all see when we first install ESXi and then promptly forget exists. This service can be stopped (and configured to not auto-start) which prevents any operations from occurring at the console or over a KVM. Be very careful and know the impact of this change. If you misconfigure a vSwitch and knock your host management kernel port offline, there\'s no parachute to reset the host vSwitch and you might be reaching for an ESXi install disk.</li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Disable ESXi Shell unless needed for diagnostics or troubleshooting\r\n<ul>\r\n	<li>Title: disable-esxi-shell</li>\r\n	<li>Discussion: This is known by some as the ESXi command line, formerly known as Tech Support Mode. From an ESXi console, you can press Alt+F1 and login as root to access a BusyBox environment that looks and acts a bit like Linux but has full control over host operations. The ESXi Shell should be started as necessary through the vSphere console for troubleshooting purposes and remain stopped the rest of the time.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/1017910\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 3','','inherit','open','open','','6940-revision-8','','','2012-06-27 04:20:58','2012-06-27 04:20:58','',6940,'http://egroup.jasonmangone.com/6940-revision-8',0,'revision','',0),(6949,35,'2012-06-27 04:22:40','2012-06-27 04:22:40','If you\'re just joining us, I\'m blogging my way through the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a>. The preceding posts, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a> and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a>, are also available. Today\'s post discusses self-signed certificates, the DCUI console, and the memorable ESXi shell. Let\'s dive in!\r\n<ul>\r\n	<li>Guideline Title: Enable SSL for NFC\r\n<ul>\r\n	<li>Title: enable-nfc-ssl</li>\r\n	<li>Discussion: NFC (Network File Copy) is used to copy or migrate VMs between ESXi hosts. The vulnerability being addressed here is network traffic sniffing. If an attacker sniffed NFC traffic as it was being used to ship an entire VM, they would get an effective duplicate of your entire virtual server. Normally turning SSL on here would be an easy decision to recommend, but in this case, VMware\'s guidance on this issue is that NFC over SSL between ESXi hosts \"has ... not been extensively tested and so may cause HA and other operations to fail in certain circumstances.\" Ouch. We\'ll keep our eye on this one and hope that NFC over SSL gets more testing in the future. In the meantime, make sure your vSphere management networks and VLANs are sufficiently isolated as a partial mitigation.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/2010332\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title:  Do not use default self-signed certificates for ESXi communication\r\n<ul>\r\n	<li>Title: esxi-no-self-signed-certs</li>\r\n	<li>Discussion: This hardening guidance is written towards vSphere, but it\'s always good guidance for any system that uses encryption, even plain ol\' Windows Remote Desktop! Wikipedia has a <a href=\"http://en.wikipedia.org/wiki/Man-in-the-middle_attack\">detailed explanation of man-in-the-middle attacks</a>, but here\'s the gist: whenever you choose to connect to a server with an unverified SSL certificate, you have no certainty that your encrypted SSL tunnel reaches all the way to the server you\'re talking to. It\'s possible that your traffic is being intercepted, decrypted, stored, re-encrypted, and sent to its destination - all without you or the server you\'re connecting to being aware your traffic was intercepted. Self-signed SSL certs are generic and hard to distinguish from each other. They also lose the benefit of having a Certificate Authority confirm the validity of the cert. The solution is always replace default/vendor certificates on all network endpoints with certs issued by a commercial or organizational Certificate Authority.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.solutions.doc_50/GUID-37AAEDFE-EF2E-45FC-B0C6-44841E4FB302.html\">VMware Official documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Prevent unintended use of dvfilter network APIs\r\n<ul>\r\n	<li>Title: verify-dvfilter-bind</li>\r\n	<li>Discussion: The dvfilter network APIs are part of the larger <a href=\"http://blogs.vmware.com/vcloud/2010/04/what-actually-is-vmsafe-and-the-vmsafe-api.html\">VMsafe API</a> and they allow VMware partners to develop virtual security appliances to control the behavior of guest virtual machines. These virtual appliances have the benefit of simplifying guest VM configuration while increasing the overall security of your environment. Some great examples of this include <a href=\"http://www.trendmicro.com/us/enterprise/cloud-solutions/deep-security/index.html\">Trend Micro Deep Security</a>, the <a href=\"http://www.cisco.com/en/US/products/ps11208/index.html\">Cisco Virtual Security Gateway</a>, and the <a href=\"http://www.juniper.net/us/en/products-services/software/security/vgw-series/\">Juniper Virtual Gateway</a>. These appliances allow you to manage firewalls around your VMs as easily as dragging and dropping VMs in vCenter, enabling secure VM isolation (e.g. \"DEV servers can\'t talk to PROD servers\") but without sacrificing any ease of management (one of the reasons we virtualized everything in the first place, right?) These virtual security appliances using the dvfilter APIs receive privileged access to other guest VM network traffic. If you\'re not using any security appliances that leverage these APIs, you\'ll want to confirm they\'re not in use to prevent a malicious VM from receiving the data instead.</li>\r\n	<li>Official VMware documentation is still TBD</li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Disable DCUI to prevent local administrative control\r\n<ul>\r\n	<li>Title: disable-dcui</li>\r\n	<li>Discussion: <strong>NOTE: This is only recommended by VMware for the most secure environments. </strong>The DCUI is the name of the service that runs the gray and yellow console screen we all see when we first install ESXi and then promptly forget exists. This service can be stopped (and configured to not auto-start) which prevents any operations from occurring at the console or over a KVM. Be very careful and know the impact of this change. If you misconfigure a vSwitch and knock your host management kernel port offline, there\'s no parachute to reset the host vSwitch and you might be reaching for an ESXi install disk.</li>\r\n	<li>Official VMware documentation is still TBD</li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Disable ESXi Shell unless needed for diagnostics or troubleshooting\r\n<ul>\r\n	<li>Title: disable-esxi-shell</li>\r\n	<li>Discussion: This is known by some as the ESXi command line, formerly known as Tech Support Mode. From an ESXi console, you can press Alt+F1 and login as root to access a BusyBox environment that looks and acts a bit like Linux but has full control over host operations. The ESXi Shell should be started as necessary through the vSphere console for troubleshooting purposes and remain stopped the rest of the time.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/1017910\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 3','','inherit','open','open','','6940-revision-9','','','2012-06-27 04:22:40','2012-06-27 04:22:40','',6940,'http://egroup.jasonmangone.com/6940-revision-9',0,'revision','',0),(6950,35,'2012-06-27 04:22:42','2012-06-27 04:22:42','If you\'re just joining us, I\'m blogging my way through the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a>. The preceding posts, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a> and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a>, are also available. Today\'s post discusses self-signed certificates, the DCUI console, and the memorable ESXi shell. Let\'s dive in!\r\n<ul>\r\n	<li>Guideline Title: Enable SSL for NFC\r\n<ul>\r\n	<li>Title: enable-nfc-ssl</li>\r\n	<li>Discussion: NFC (Network File Copy) is used to copy or migrate VMs between ESXi hosts. The vulnerability being addressed here is network traffic sniffing. If an attacker sniffed NFC traffic as it was being used to ship an entire VM, they would get an effective duplicate of your entire virtual server. Normally turning SSL on here would be an easy decision to recommend, but in this case, VMware\'s guidance on this issue is that NFC over SSL between ESXi hosts \"has ... not been extensively tested and so may cause HA and other operations to fail in certain circumstances.\" Ouch. We\'ll keep our eye on this one and hope that NFC over SSL gets more testing in the future. In the meantime, make sure your vSphere management networks and VLANs are sufficiently isolated as a partial mitigation.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/2010332\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title:  Do not use default self-signed certificates for ESXi communication\r\n<ul>\r\n	<li>Title: esxi-no-self-signed-certs</li>\r\n	<li>Discussion: This hardening guidance is written towards vSphere, but it\'s always good guidance for any system that uses encryption, even plain ol\' Windows Remote Desktop! Wikipedia has a <a href=\"http://en.wikipedia.org/wiki/Man-in-the-middle_attack\">detailed explanation of man-in-the-middle attacks</a>, but here\'s the gist: whenever you choose to connect to a server with an unverified SSL certificate, you have no certainty that your encrypted SSL tunnel reaches all the way to the server you\'re talking to. It\'s possible that your traffic is being intercepted, decrypted, stored, re-encrypted, and sent to its destination - all without you or the server you\'re connecting to being aware your traffic was intercepted. Self-signed SSL certs are generic and hard to distinguish from each other. They also lose the benefit of having a Certificate Authority confirm the validity of the cert. The solution is always replace default/vendor certificates on all network endpoints with certs issued by a commercial or organizational Certificate Authority.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.solutions.doc_50/GUID-37AAEDFE-EF2E-45FC-B0C6-44841E4FB302.html\">VMware Official documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Prevent unintended use of dvfilter network APIs\r\n<ul>\r\n	<li>Title: verify-dvfilter-bind</li>\r\n	<li>Discussion: The dvfilter network APIs are part of the larger <a href=\"http://blogs.vmware.com/vcloud/2010/04/what-actually-is-vmsafe-and-the-vmsafe-api.html\">VMsafe API</a> and they allow VMware partners to develop virtual security appliances to control the behavior of guest virtual machines. These virtual appliances have the benefit of simplifying guest VM configuration while increasing the overall security of your environment. Some great examples of this include <a href=\"http://www.trendmicro.com/us/enterprise/cloud-solutions/deep-security/index.html\">Trend Micro Deep Security</a>, the <a href=\"http://www.cisco.com/en/US/products/ps11208/index.html\">Cisco Virtual Security Gateway</a>, and the <a href=\"http://www.juniper.net/us/en/products-services/software/security/vgw-series/\">Juniper Virtual Gateway</a>. These appliances allow you to manage firewalls around your VMs as easily as dragging and dropping VMs in vCenter, enabling secure VM isolation (e.g. \"DEV servers can\'t talk to PROD servers\") but without sacrificing any ease of management (one of the reasons we virtualized everything in the first place, right?) These virtual security appliances using the dvfilter APIs receive privileged access to other guest VM network traffic. If you\'re not using any security appliances that leverage these APIs, you\'ll want to confirm they\'re not in use to prevent a malicious VM from receiving the data instead.</li>\r\n	<li>Official VMware documentation is still TBD</li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Disable DCUI to prevent local administrative control\r\n<ul>\r\n	<li>Title: disable-dcui</li>\r\n	<li>Discussion: <strong>NOTE: This is only recommended by VMware for the most secure environments. </strong>The DCUI is the name of the service that runs the gray and yellow console screen we all see when we first install ESXi and then promptly forget exists. This service can be stopped (and configured to not auto-start) which prevents any operations from occurring at the console or over a KVM. Be very careful and know the impact of this change. If you misconfigure a vSwitch and knock your host management kernel port offline, there\'s no parachute to reset the host vSwitch and you might be reaching for an ESXi install disk.</li>\r\n	<li>Official VMware documentation is still TBD</li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Disable ESXi Shell unless needed for diagnostics or troubleshooting\r\n<ul>\r\n	<li>Title: disable-esxi-shell</li>\r\n	<li>Discussion: This is known by some as the ESXi command line, formerly known as Tech Support Mode. From an ESXi console, you can press Alt+F1 and login as root to access a BusyBox environment that looks and acts a bit like Linux but has full control over host operations. The ESXi Shell should be started as necessary through the vSphere console for troubleshooting purposes and remain stopped the rest of the time.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/1017910\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 3','','inherit','open','open','','6940-revision-10','','','2012-06-27 04:22:42','2012-06-27 04:22:42','',6940,'http://egroup.jasonmangone.com/6940-revision-10',0,'revision','',0),(6951,35,'2012-06-27 04:23:12','2012-06-27 04:23:12','If you\'re just joining us, I\'m blogging my way through the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a>. The preceding posts, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a> and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a>, are also available. Today\'s post discusses self-signed certificates, the DCUI console, and the memorable ESXi shell. Let\'s dive in!\r\n<ul>\r\n	<li>Guideline Title: Enable SSL for NFC\r\n<ul>\r\n	<li>Title: enable-nfc-ssl</li>\r\n	<li>Discussion: NFC (Network File Copy) is used to copy or migrate VMs between ESXi hosts. The vulnerability being addressed here is network traffic sniffing. If an attacker sniffed NFC traffic as it was being used to ship an entire VM, they would get an effective duplicate of your entire virtual server. Normally turning SSL on here would be an easy decision to recommend, but in this case, VMware\'s guidance on this issue is that NFC over SSL between ESXi hosts \"has ... not been extensively tested and so may cause HA and other operations to fail in certain circumstances.\" Ouch. We\'ll keep our eye on this one and hope that NFC over SSL gets more testing in the future. In the meantime, make sure your vSphere management networks and VLANs are sufficiently isolated as a partial mitigation.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/2010332\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title:  Do not use default self-signed certificates for ESXi communication\r\n<ul>\r\n	<li>Title: esxi-no-self-signed-certs</li>\r\n	<li>Discussion: This hardening guidance is written towards vSphere, but it\'s always good guidance for any system that uses encryption, even plain ol\' Windows Remote Desktop! Wikipedia has a <a href=\"http://en.wikipedia.org/wiki/Man-in-the-middle_attack\">detailed explanation of man-in-the-middle attacks</a>, but here\'s the gist: whenever you choose to connect to a server with an unverified SSL certificate, you have no certainty that your encrypted SSL tunnel reaches all the way to the server you\'re talking to. It\'s possible that your traffic is being intercepted, decrypted, stored, re-encrypted, and sent to its destination - all without you or the server you\'re connecting to being aware your traffic was intercepted. Self-signed SSL certs are generic and hard to distinguish from each other. They also lose the benefit of having a Certificate Authority confirm the validity of the cert. The solution is always replace default/vendor certificates on all network endpoints with certs issued by a commercial or organizational Certificate Authority.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.solutions.doc_50/GUID-37AAEDFE-EF2E-45FC-B0C6-44841E4FB302.html\">VMware Official documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Prevent unintended use of dvfilter network APIs\r\n<ul>\r\n	<li>Title: verify-dvfilter-bind</li>\r\n	<li>Discussion: The dvfilter network APIs are part of the larger <a href=\"http://blogs.vmware.com/vcloud/2010/04/what-actually-is-vmsafe-and-the-vmsafe-api.html\">VMsafe API</a> and they allow VMware partners to develop virtual security appliances to control the behavior of guest virtual machines. These virtual appliances have the benefit of simplifying guest VM configuration while increasing the overall security of your environment. Some great examples of this include <a href=\"http://www.trendmicro.com/us/enterprise/cloud-solutions/deep-security/index.html\">Trend Micro Deep Security</a>, the <a href=\"http://www.cisco.com/en/US/products/ps11208/index.html\">Cisco Virtual Security Gateway</a>, and the <a href=\"http://www.juniper.net/us/en/products-services/software/security/vgw-series/\">Juniper Virtual Gateway</a>. These appliances allow you to manage firewalls around your VMs as easily as dragging and dropping VMs in vCenter, enabling secure VM isolation (e.g. \"DEV servers can\'t talk to PROD servers\") but without sacrificing any ease of management (one of the reasons we virtualized everything in the first place, right?) These virtual security appliances using the dvfilter APIs receive privileged access to other guest VM network traffic. If you\'re not using any security appliances that leverage these APIs, you\'ll want to confirm they\'re not in use to prevent a malicious VM from receiving the data instead.</li>\r\n	<li>Official VMware documentation is still TBD</li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Disable DCUI to prevent local administrative control\r\n<ul>\r\n	<li>Title: disable-dcui</li>\r\n	<li>Discussion: <strong>NOTE: This is only recommended by VMware for the most secure environments. </strong>The DCUI is the name of the service that runs the gray and yellow console screen we all see when we first install ESXi and then promptly forget exists. This service can be stopped (and configured to not auto-start) which prevents any operations from occurring at the console or over a KVM. Be very careful and know the impact of this change. If you misconfigure a vSwitch and knock your host management kernel port offline, there\'s no parachute to reset the host vSwitch and you might be reaching for an ESXi install disk.</li>\r\n	<li>Official VMware documentation is still TBD</li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Disable ESXi Shell unless needed for diagnostics or troubleshooting\r\n<ul>\r\n	<li>Title: disable-esxi-shell</li>\r\n	<li>Discussion: This is known by some as the ESXi command line, formerly known as Tech Support Mode. From an ESXi console, you can press Alt+F1 and login as root to access a BusyBox environment that looks and acts a bit like Linux but has full control over host operations. The ESXi Shell should be started as necessary through the vSphere console for troubleshooting purposes and remain stopped the rest of the time.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/1017910\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 3','','inherit','open','open','','6940-revision-11','','','2012-06-27 04:23:12','2012-06-27 04:23:12','',6940,'http://egroup.jasonmangone.com/6940-revision-11',0,'revision','',0),(7014,25,'2012-09-07 09:35:14','2012-09-07 13:35:14','Recently I deployed Citrix XenApp 6.5 on virtual machines using a template I had previously created.  The machines provisioned without error, and appeared to be working properly.  Unfortunately, I was unable to open a remote desktop session onto the virtual server.  After researching the issue, I found a registry entry that corrected the problem.  I added a new DWORD called \"IgnoreRegConfigErrors\" with a value of \"1\" to the HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server directory.\n\nOther troubleshooting methods that may be useful are disabling any unused NICs on the server, and disabling IPv6 if using IPv4.','Citrix XenApp 6.5 RDP Access Denied','','inherit','open','open','','6999-autosave','','','2012-09-07 09:35:14','2012-09-07 13:35:14','',6999,'http://egroup.jasonmangone.com/6999-autosave',0,'revision','',0),(6953,2,'2012-06-27 13:39:36','2012-06-27 13:39:36','Microsoft just announced active exploits with no patch. eGroup would like to help you stay protected until a patch is available.\r\n\r\n<a href=\"http://blog.trendmicro.com/trend-micro-protects-users-against-active-exploits-on-latest-internet-explorer-vulnerabilities/\">Microsoft advised</a> that active zero-day attacks could allow control of a user\'s system through its browser. This vulnerability in Microsoft XML Core Services affects all supported versions of Microsoft Windows, and Office 2003 and 2007.\r\n\r\nWithout a patch, no amount of time or money can protect you. Unless you have virtual patching. <a href=\"http://www.trendmicro.com/cloud-content/us/pdfs/business/white-papers/idc-virtual-patching.pdf\">IDC recommends virtual patching</a> as a successful strategy for controlling vulnerabilities. Available in Deep Security, virtual patching automatically shields Windows systems from new vulnerabilities until a patch is available. So you can afford to schedule your software patches after they are available and successfully tested.\r\n\r\nCall us now to find out how quickly you can shield against active exploits. We recommend that you test the virtual patching capabilities in <a href=\"http://www.trendmicro.com/us/enterprise/cloud-solutions/deep-security/index.html\">Deep Security</a>.\r\n\r\n1.877.eGROUP.1\r\n<a href=\"http://www.eGroup-us.com\">www.eGroup-us.com</a>\r\n<a href=\"mailto:sales@eGroup-us.com\">sales@eGroup-us.com</a>\r\n\r\n&nbsp;','MICROSOFT ANNOUNCED ACTIVE EXPLOITS WITH NO PATCH.  TREND MICRO HAS YOU COVERED WITH VIRTUAL PATCHING.','','publish','open','open','','microsoft-announced-active-exploits-with-no-patch-trend-micro-has-you-covered-with-virtual-patching','','','2012-06-27 13:39:36','2012-06-27 13:39:36','',0,'http://egroup.jasonmangone.com/?p=6953',0,'post','',0),(6954,2,'2012-06-27 13:36:55','2012-06-27 13:36:55','Microsoft just announced active exploits with no patch. eGroup would like to help you stay protected until a patch is available.\n\n<a href=\"http://blog.trendmicro.com/trend-micro-protects-users-against-active-exploits-on-latest-internet-explorer-vulnerabilities/\">Microsoft advised</a> that active zero-day attacks could allow control of a user\'s system through its browser. This vulnerability in Microsoft XML Core Services affects all supported versions of Microsoft Windows, and Office 2003 and 2007.\n\nWithout a patch, no amount of time or money can protect you. Unless you have virtual patching. <a href=\"http://www.trendmicro.com/cloud-content/us/pdfs/business/white-papers/idc-virtual-patching.pdf\">IDC recommends virtual patching</a> as a successful strategy for controlling vulnerabilities. Available in Deep Security, virtual patching automatically shields Windows systems from new vulnerabilities until a patch is available. So you can afford to schedule your software patches after they are available and successfully tested.\n\nCall us now to find out how quickly you can shield against active exploits. We recommend that you test the virtual patching capabilities in Deep Security.\n\n1.877.eGROUP.1\n<a href=\"http://www.eGroup-us.com\">www.eGroup-us.com</a>\n<a href=\"mailto:sales@eGroup-us.com\">sales@eGroup-us.com</a>\n\n&nbsp;','Microsoft announced active exploits with no patch.  Trend Micro has you covered with virtual patching.','','inherit','open','open','','6953-revision','','','2012-06-27 13:36:55','2012-06-27 13:36:55','',6953,'http://egroup.jasonmangone.com/6953-revision',0,'revision','',0),(6955,2,'2012-06-27 13:38:12','2012-06-27 13:38:12','Microsoft just announced active exploits with no patch. eGroup would like to help you stay protected until a patch is available.\n\n<a href=\"http://blog.trendmicro.com/trend-micro-protects-users-against-active-exploits-on-latest-internet-explorer-vulnerabilities/\">Microsoft advised</a> that active zero-day attacks could allow control of a user\'s system through its browser. This vulnerability in Microsoft XML Core Services affects all supported versions of Microsoft Windows, and Office 2003 and 2007.\n\nWithout a patch, no amount of time or money can protect you. Unless you have virtual patching. <a href=\"http://www.trendmicro.com/cloud-content/us/pdfs/business/white-papers/idc-virtual-patching.pdf\">IDC recommends virtual patching</a> as a successful strategy for controlling vulnerabilities. Available in Deep Security, virtual patching automatically shields Windows systems from new vulnerabilities until a patch is available. So you can afford to schedule your software patches after they are available and successfully tested.\n\nCall us now to find out how quickly you can shield against active exploits. We recommend that you test the virtual patching capabilities in <a href=\"http://www.trendmicro.com/us/enterprise/cloud-solutions/deep-security/index.html\">Deep Security</a>.\n\n1.877.eGROUP.1\n<a href=\"http://www.eGroup-us.com\">www.eGroup-us.com</a>\n<a href=\"mailto:sales@eGroup-us.com\">sales@eGroup-us.com</a>\n\n&nbsp;','MICROSOFT ANNOUNCED ACTIVE EXPLOITS WITH NO PATCH.  TREND MICRO HAS YOU COVERED WITH VIRTUAL PATCHING.','','inherit','open','open','','6953-revision-2','','','2012-06-27 13:38:12','2012-06-27 13:38:12','',6953,'http://egroup.jasonmangone.com/6953-revision-2',0,'revision','',0),(6956,2,'2012-06-11 19:49:57','2012-06-11 19:49:57','Headquartered in South Carolina with offices throughout the entire southeast, eGroup is always looking for upbeat, driven and self-motivated \"go getters\" to join our rapidly growing team! Available positions include:\r\n<ul>\r\n	<li><span style=\"text-decoration: underline;\"><strong>eGroup Sales Account Executive</strong></span>: As an eGroup Sales Executive, you will utilize your sales experience to extend eGroup’s products, services, and solutions to executive management in a defined geography or strategic area, with an emphasis on selling products and services as “solutions” designed to directly address the business initiatives and requirements of these customers. Professional territory management and account development skills are a must. You must be motivated to generate new business, provide excellent customer service, and be self-reliant. You must be able to prospect, qualify, engage, and manage all the elements of a complex solution sale. <a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2011/08/eGROUP-Sales-Account-Executive2.pdf\">More</a></li>\r\n	<li><span style=\"text-decoration: underline;\"><strong>eGroup Inside Sales Executive</strong></span>: This is an excellent opportunity for the sales professional with a positive, “can do” attitude. The right individual will be responsible for engaging customers, vendors, distributors, and manufacturers to assist eGroup in building maintaining, and delivering its sales pipeline. This will include lead qualification, proposal development, and writing with customer follow-up. This is a fantastic opportunity to work within a growing organization while mastering your skills. As an eGroup Inside Sales Executive, you will utilize your skills and drive to assist our Outside Sales team in extending eGroup’s products, services, and solutions to customers and prospects. You must be motivated to provide excellent customer service, work well in a team environment, and be self-reliant. <a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2011/08/eGROUP-Inside-Sales-Executive1.pdf\">More</a></li>\r\n	<li><span style=\"text-decoration: underline;\"><strong>eGroup Technical Consultant</strong></span>: An excellent opportunity for the motivated technical sales professional, you\'ll be backed by eGroup\'s continual investment in market proven technologies and support resources.  These \"best of breed\" technology offerings will position you for success in delivering sophisticated solutions to a growing set of customers with increasingly complex needs. This position primarily focuses on consultation, design and deployment of VMware, EMC, Cisco, Microsoft and Citrix technologies. You will work directly with our outside and inside sales teams to meet with current and prospective customers, understand their needs, and propose technology solutions to help them overcome their challenges based on intimate knowledge of eGroup services, products and technologies.</li>\r\n	<li><span style=\"text-decoration: underline;\"><strong>eGroup Applications Services Engineer</strong></span>: An excellent opportunity for the motivated professional to be a part of a growing team of application and development focused professionals; the role of the Application Services Engineer is to assist in the design, deployment  and support of custom-developed and commercial application solutions that address business needs.  You will be customer facing, must be able to discuss with customers their unique business challenges and to communicate complex technical objectives in a detailed manner that can be received by audiences of all technical levels. You will work with the Application Services team to identify and develop new opportunities within the existing customer base. <a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2011/08/ApplicationServicesEngineer.pdf\">More</a></li>\r\n	<li><span style=\"text-decoration: underline;\"><strong>eGroup Junior Applications Services Engineer</strong></span>: The role of the Junior Application Services Engineer is to assist in the design, deployment and support of custom-developed and commercial application solutions that address business needs.  You may work as part of a team or individually on tasks and projects of varying size and scope, clearly  documenting and delivering solutions that directly address customer requirements on time and within the defined scope of work.  You should have a firm understanding of theoretical computer science and applications development using object oriented techniques.   <a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2011/08/JuniorApplicationServicesEngineer.pdf\">More</a></li>\r\n	<li><span style=\"text-decoration: underline;\"><strong>eGroup Systems Engineer</strong></span>:  This position primarily focuses on design, deployment, and support of VMware, EMC, Cisco, Microsoft and Citrix technologies. You will respond to and investigate end user inquiries, concerns, and issues via phone, Internet, e‐mail, and in person in a timely and courteous manner, and will recommend or perform actions to correct problems based on intimate knowledge of the technology or specific systems.  You should be proficient in communication both verbal and written, and be extremely passionate about technology. You should be a self‐motivated and driven individual capable of learning quickly and adapting to the latest industry trends and best practices. As a representative of eGroup, you must demonstrate a positive attitude and willingness to go above and beyond to ensure complete customer satisfaction. <a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2011/08/eGROUP-Systems-Engineer2.pdf\">More</a></li>\r\n</ul>\r\n<strong>To apply or for more information: <a href=\"mailto:hr@eGroup-us.com\">hr@eGroup-us.com</a></strong>','Careers','','inherit','open','open','','4668-revision-v1','','','2012-06-11 19:49:57','2012-06-11 19:49:57','',4668,'http://egroup.jasonmangone.com/4668-revision-55',0,'revision','',0),(6960,2,'2012-06-27 13:48:10','2012-06-27 13:48:10','Headquartered in South Carolina with offices throughout the entire southeast, eGroup is always looking for upbeat, driven and self-motivated \"go getters\" to join our rapidly growing team! Available positions include:\r\n<ul>\r\n	<li><span style=\"text-decoration: underline;\"><strong>eGroup Sales Account Executive</strong></span>: As an eGroup Sales Executive, you will utilize your sales experience to extend eGroup’s products, services, and solutions to executive management in a defined geography or strategic area, with an emphasis on selling products and services as “solutions” designed to directly address the business initiatives and requirements of these customers. Professional territory management and account development skills are a must. You must be motivated to generate new business, provide excellent customer service, and be self-reliant. You must be able to prospect, qualify, engage, and manage all the elements of a complex solution sale. <a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2011/08/eGROUP-Sales-Account-Executive2.pdf\">More</a></li>\r\n	<li><span style=\"text-decoration: underline;\"><strong>eGroup Inside Sales Executive</strong></span>: This is an excellent opportunity for the sales professional with a positive, “can do” attitude. The right individual will be responsible for engaging customers, vendors, distributors, and manufacturers to assist eGroup in building maintaining, and delivering its sales pipeline. This will include lead qualification, proposal development, and writing with customer follow-up. This is a fantastic opportunity to work within a growing organization while mastering your skills. As an eGroup Inside Sales Executive, you will utilize your skills and drive to assist our Outside Sales team in extending eGroup’s products, services, and solutions to customers and prospects. You must be motivated to provide excellent customer service, work well in a team environment, and be self-reliant. <a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2011/08/eGROUP-Inside-Sales-Executive1.pdf\">More</a></li>\r\n	<li><span style=\"text-decoration: underline;\"><strong>eGroup Technical Consultant</strong></span>: An excellent opportunity for the motivated technical sales professional, you\'ll be backed by eGroup\'s continual investment in market proven technologies and support resources.  These \"best of breed\" technology offerings will position you for success in delivering sophisticated solutions to a growing set of customers with increasingly complex needs. This position primarily focuses on consultation, design and deployment of VMware, EMC, Cisco, Microsoft and Citrix technologies. You will work directly with our outside and inside sales teams to meet with current and prospective customers, understand their needs, and propose technology solutions to help them overcome their challenges based on intimate knowledge of eGroup services, products and technologies.</li>\r\n	<li><span style=\"text-decoration: underline;\"><strong>eGroup Applications Services Engineer</strong></span>: An excellent opportunity for the motivated professional to be a part of a growing team of application and development focused professionals; the role of the Application Services Engineer is to assist in the design, deployment  and support of custom-developed and commercial application solutions that address business needs.  You will be customer facing, must be able to discuss with customers their unique business challenges and to communicate complex technical objectives in a detailed manner that can be received by audiences of all technical levels. You will work with the Application Services team to identify and develop new opportunities within the existing customer base. <a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2011/08/ApplicationServicesEngineer.pdf\">More</a></li>\r\n	<li><span style=\"text-decoration: underline;\"><strong>eGroup Junior Applications Services Engineer</strong></span>: The role of the Junior Application Services Engineer is to assist in the design, deployment and support of custom-developed and commercial application solutions that address business needs.  You may work as part of a team or individually on tasks and projects of varying size and scope, clearly  documenting and delivering solutions that directly address customer requirements on time and within the defined scope of work.  You should have a firm understanding of theoretical computer science and applications development using object oriented techniques.   <a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2011/08/JuniorApplicationServicesEngineer.pdf\">More</a></li>\r\n	<li><span style=\"text-decoration: underline;\"><strong>eGroup Systems Engineer</strong></span>:  This position primarily focuses on design, deployment, and support of VMware, EMC, Cisco, Microsoft and Citrix technologies. You will respond to and investigate end user inquiries, concerns, and issues via phone, Internet, e‐mail, and in person in a timely and courteous manner, and will recommend or perform actions to correct problems based on intimate knowledge of the technology or specific systems.  You should be proficient in communication both verbal and written, and be extremely passionate about technology. You should be a self‐motivated and driven individual capable of learning quickly and adapting to the latest industry trends and best practices. As a representative of eGroup, you must demonstrate a positive attitude and willingness to go above and beyond to ensure complete customer satisfaction. <a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2011/08/eGROUP-Systems-Engineer2.pdf\">More</a></li>\r\n</ul>\r\n<strong>To apply or for more information: <a href=\"mailto:hr@eGroup-us.com\">hr@eGroup-us.com</a></strong>','Careers','','inherit','open','open','','4668-revision-v1','','','2012-06-27 13:48:10','2012-06-27 13:48:10','',4668,'http://egroup.jasonmangone.com/4668-revision-57',0,'revision','',0),(6957,2,'2012-06-27 13:46:51','2012-06-27 13:46:51','','More','','inherit','open','open','','egroup-technical-consultant-3','','','2012-06-27 13:46:51','2012-06-27 13:46:51','',4668,'http://egroup.jasonmangone.com/wp-content/uploads/2011/08/eGROUP-Technical-Consultant2.pdf',0,'attachment','application/pdf',0),(6958,2,'2012-06-27 13:44:10','2012-06-27 13:44:10','Headquartered in South Carolina with offices throughout the entire southeast, eGroup is always looking for upbeat, driven and self-motivated \"go getters\" to join our rapidly growing team! Available positions include:\r\n<ul>\r\n	<li><span style=\"text-decoration: underline;\"><strong>eGroup Sales Account Executive</strong></span>: As an eGroup Sales Executive, you will utilize your sales experience to extend eGroup’s products, services, and solutions to executive management in a defined geography or strategic area, with an emphasis on selling products and services as “solutions” designed to directly address the business initiatives and requirements of these customers. Professional territory management and account development skills are a must. You must be motivated to generate new business, provide excellent customer service, and be self-reliant. You must be able to prospect, qualify, engage, and manage all the elements of a complex solution sale. <a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2011/08/eGROUP-Sales-Account-Executive2.pdf\">More</a></li>\r\n	<li><span style=\"text-decoration: underline;\"><strong>eGroup Inside Sales Executive</strong></span>: This is an excellent opportunity for the sales professional with a positive, “can do” attitude. The right individual will be responsible for engaging customers, vendors, distributors, and manufacturers to assist eGroup in building maintaining, and delivering its sales pipeline. This will include lead qualification, proposal development, and writing with customer follow-up. This is a fantastic opportunity to work within a growing organization while mastering your skills. As an eGroup Inside Sales Executive, you will utilize your skills and drive to assist our Outside Sales team in extending eGroup’s products, services, and solutions to customers and prospects. You must be motivated to provide excellent customer service, work well in a team environment, and be self-reliant. <a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2011/08/eGROUP-Inside-Sales-Executive1.pdf\">More</a></li>\r\n	<li><span style=\"text-decoration: underline;\"><strong>eGroup Technical Consultant</strong></span>: An excellent opportunity for the motivated technical sales professional, you\'ll be backed by eGroup\'s continual investment in market proven technologies and support resources.  These \"best of breed\" technology offerings will position you for success in delivering sophisticated solutions to a growing set of customers with increasingly complex needs. This position primarily focuses on consultation, design and deployment of VMware, EMC, Cisco, Microsoft and Citrix technologies. You will work directly with our outside and inside sales teams to meet with current and prospective customers, understand their needs, and propose technology solutions to help them overcome their challenges based on intimate knowledge of eGroup services, products and technologies. More</li>\r\n	<li><span style=\"text-decoration: underline;\"><strong>eGroup Applications Services Engineer</strong></span>: An excellent opportunity for the motivated professional to be a part of a growing team of application and development focused professionals; the role of the Application Services Engineer is to assist in the design, deployment  and support of custom-developed and commercial application solutions that address business needs.  You will be customer facing, must be able to discuss with customers their unique business challenges and to communicate complex technical objectives in a detailed manner that can be received by audiences of all technical levels. You will work with the Application Services team to identify and develop new opportunities within the existing customer base. <a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2011/08/ApplicationServicesEngineer.pdf\">More</a></li>\r\n	<li><span style=\"text-decoration: underline;\"><strong>eGroup Junior Applications Services Engineer</strong></span>: The role of the Junior Application Services Engineer is to assist in the design, deployment and support of custom-developed and commercial application solutions that address business needs.  You may work as part of a team or individually on tasks and projects of varying size and scope, clearly  documenting and delivering solutions that directly address customer requirements on time and within the defined scope of work.  You should have a firm understanding of theoretical computer science and applications development using object oriented techniques.   <a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2011/08/JuniorApplicationServicesEngineer.pdf\">More</a></li>\r\n	<li><span style=\"text-decoration: underline;\"><strong>eGroup Systems Engineer</strong></span>:  This position primarily focuses on design, deployment, and support of VMware, EMC, Cisco, Microsoft and Citrix technologies. You will respond to and investigate end user inquiries, concerns, and issues via phone, Internet, e‐mail, and in person in a timely and courteous manner, and will recommend or perform actions to correct problems based on intimate knowledge of the technology or specific systems.  You should be proficient in communication both verbal and written, and be extremely passionate about technology. You should be a self‐motivated and driven individual capable of learning quickly and adapting to the latest industry trends and best practices. As a representative of eGroup, you must demonstrate a positive attitude and willingness to go above and beyond to ensure complete customer satisfaction. <a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2011/08/eGROUP-Systems-Engineer2.pdf\">More</a></li>\r\n</ul>\r\n<strong>To apply or for more information: <a href=\"mailto:hr@eGroup-us.com\">hr@eGroup-us.com</a></strong>','Careers','','inherit','open','open','','4668-revision-v1','','','2012-06-27 13:44:10','2012-06-27 13:44:10','',4668,'http://egroup.jasonmangone.com/4668-revision-56',0,'revision','',0),(6962,24,'2012-06-27 14:58:22','2012-06-27 14:58:22','Ran into an issue where I already had a stack of two 2960\'s that was working properly.  I went to add a third switch to the stack and it took over as switch 1 and thats when the fun began.  \r\n\r\n<!--more-->\r\n\r\nThe switch stack was powered down before the new switch was added.  If it had been added when the stack was powered on I should not have had any issues.  The new switch decided to become switch 1 and the old switch one became switch 3.  This caused all of the port configurations to be wrong so everything that was plugged into the old switch 1 stopped working since it was now switch 3.  Here are the commands I used to fix.\r\n\r\nFirst I did not want the new switch to become master so I used the command:\r\n\r\nSwitch(config)#switch 3 priority 15\r\n\r\nI wanted the second switch to be the backup master so I entered the command:\r\n\r\nSwitch(config)#switch 2 priority 14\r\n\r\nNow I needed to renumber the switchs so they were in the correct order.  I entered the following commands:\r\n\r\nSwitch(config)#switch 3 renumber 1\r\nSwitch(config)#switch 1 renumber 3\r\nSwitch(config)#exit\r\nSwitch#copy run start\r\n\r\nI then reloaded the stack and everything came back up and was working.\r\n\r\n','Cisco Stack Re-Numbering','','publish','open','open','','cisco-stack-re-numbering','','','2012-06-27 14:58:22','2012-06-27 14:58:22','',0,'http://egroup.jasonmangone.com/?p=6962',0,'post','',0),(6963,24,'2012-06-27 14:58:11','2012-06-27 14:58:11','Ran into an issue where I already had a stack of two 2960\'s that was working properly.  I went to add a third switch to the stack and it took over as switch 1 and thats when the fun began.  \n\n<!--more-->\n\nThe switch stack was powered down before the new switch was added.  If it had been added when the stack was powered on I should not have had any issues.  The new switch decided to become switch 1 and the old switch one became switch 3.  This caused all of the port configurations to be wrong so everything that was plugged into the old switch 1 stopped working since it was now switch 3.  Here are the commands I used to fix.\n\nFirst I did not want the new switch to become master so I used the command:\n\nSwitch(config)#switch 3 priority 15\n\nI wanted the second switch to be the backup master so I entered the command:\n\nSwitch(config)#switch 2 priority 14\n\nNow I needed to renumber the switchs so they were in the correct order.  I entered the following commands:\n\nSwitch(config)#switch 3 renumber 1\nSwitch(config)#switch 1 renumber 3\nSwitch(config)#exit\nSwitch#copy run start\n\nI then reloaded the stack and everything came back up and was working.\n\n','Cisco Stack Re-Numbering','','inherit','open','open','','6962-revision','','','2012-06-27 14:58:11','2012-06-27 14:58:11','',6962,'http://egroup.jasonmangone.com/6962-revision',0,'revision','',0),(6964,35,'2012-06-28 08:00:33','2012-06-28 08:00:33','<div>Welcome to day 4 as we blog our way through the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a>. We\'ve already covered the first 15 ESXi security checks in parts <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a>, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a> and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-3\">three</a>. Here are our five security checks for today:</div>\r\n<ul>\r\n	<li>Guideline Title: Disable SSH\r\n<ul>\r\n	<li>Title: disable-ssh</li>\r\n	<li>Discussion: We all know and love SSH. It\'s an encrypted way to access a command line on a remote system. But the truth is that a stopped service is infinitely harder to exploit than a running service. SSH should only be enabled as necessary for troubleshooting and then should be stopped again.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-12E27BF3-3769-4665-8769-DA76C2BC9FFE.html\">Official VMware documentation<!--more--></a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Enable lockdown mode to restrict remote access\r\n<ul>\r\n	<li>Title: enable-lockdown-mode</li>\r\n	<li>Discussion: Lockdown mode is often incorrectly thought to be an extra layer of security for your ESXi hosts. What it really does is restrict who can login to the host and from where. Under normal vSphere operations, an ESXi host is managed by vCenter. However any user with the root password or a local account can connect directly to the host with the vSphere client. Since the root account it often known by more than one person, configuration changes made by \"root\" cannot be traced back to a specific individual. Lockdown modes restricts logins by all users from the vSphere client and from all users except root on the console. This forces all users to login to vCenter using Active Directory credentials in order to modify host settings and creates a record of who modified host settings and when. Note: root can still login to the local console when lockdown mode is enabled. This constitutes a change in behavior from previous versions of ESXi.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/1008077\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Do not provide root/administrator level access to CIM-based hardware monitoring tools or other 3rd party applications\r\n<ul>\r\n	<li>Title: limit-cim-access</li>\r\n	<li>Discussion: CIM modules are commonly used to monitor ESXi host hardware and are provided by vendors such as Cisco, Dell, and HP. These modules have the capability of creating additional users on ESXi hosts and these users should only be given necessary permissions for monitoring. Avoid granting root permissions if it can be avoided.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.cimsdk.smashpg.doc_50/CIM_SMASH_PG_Use_Cases.5.1.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Remove keys from SSH authorized_keys file\r\n<ul>\r\n	<li>Title: remove-authorized-keys</li>\r\n	<li>Discussion: We stated earlier that SSH is a great way to access a command line for a remote system securely and easily. But SSH access can get even easier - by using SSL key pairs. When a user generates an SSL key pair, they can choose to paste the contents of their public certificate into the /etc/ssh/keys-root/authorized_keys directory. When they open an SSH session, the ESXi host will issue a challenge encrypted with the stored public key. If the user is on a computer that stores the matching private key, the challenge can be decrypted and the user is allowed to logon without entering a password. Monitor the authorized_keys file regularly to ensure that no one has added their public key as a trusted SSH key.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-392ADDE9-FD3B-49A2-BF64-4ACBB60EB149.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Set a timeout for the ESXi Shell to automatically disable idle sessions after a predetermined period\r\n<ul>\r\n	<li>Title: set-shell-timeout</li>\r\n	<li>Discussion: SSH (even when normally disabled and used sparingly only for troubleshooting) should be configured to end idle sessions. This is the ESXi equivalent of a password-protected screensaver policy for sysadmin workstations.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/2004746\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 4','','publish','open','open','','vsphere-5-0-hardening-guide-discussion-part-4','','','2012-06-28 02:03:17','2012-06-28 02:03:17','',0,'http://egroup.jasonmangone.com/?p=6964',0,'post','',0),(6965,35,'2012-06-28 01:27:28','2012-06-28 01:27:28','<div>Welcome to day 4 as we blog our way through the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a>. We\'ve already covered the first 15 security checks in parts one, two and three. Here are our five security checks for today:</div>\n<ul>\n	<li>Guideline Title: Disable SSH\n<ul>\n	<li>Title: disable-ssh</li>\n	<li>Discussion: We all know and love SSH. It\'s an ecrypted way to access a command line on a remote system. But the truth is that a stopped service is infinitely harder to exploit than a running service. SSH should only be enabled as necessary for troubleshooting and then should be stopped again.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-12E27BF3-3769-4665-8769-DA76C2BC9FFE.html\">Official VMware documentation<!--more--></a></li>\n</ul>\n</li>\n	<li>Guideline Title: Enable lockdown mode to restrict remote access\n<ul>\n	<li>Title: enable-lockdown-mode</li>\n	<li>Discussion: Lockdown mode is often incorrectly thought to be an extra layer of security for your ESXi hosts. What it really does is retrict who can login to the host and from where. Under normal vSphere operations, an ESXi host is managed by vCenter. However any user with the root password or a local account can connect directly to the host with the vSphere client. Since the root account it often known by more than one person, configuration changes made by \"root\" cannot be traced back to a specific individual. Lockdown modes restricts logins by all users from the vSphere client and from all users except root on the console. This forces all users to login to vCenter using Active Directory credentials in order to modify host settings and creates a record of who modified host settings and when. Note: root can still login to the local console when lockdown mode is enabled. This constitutes a change in behavior from previous versions of ESXi.</li>\n	<li><a href=\"http://kb.vmware.com/kb/1008077\">Official VMware documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title: Do not provide root/administrator level access to CIM-based hardware monitoring tools or other 3rd party applications\n<ul>\n	<li>Title: limit-cim-access</li>\n	<li>Discussion: CIM modules are commonly used to monitor ESXi host hardware and are provided by vendors such as Cisco, Dell, and HP. These modules have the capability of creating additional users on ESXi hosts and these users should only be given necessary permissions for monitoring. Avoid granting root permissions if it can be avoided.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.cimsdk.smashpg.doc_50/CIM_SMASH_PG_Use_Cases.5.1.html\">Official VMware documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title: Remove keys from SSH authorized_keys file\n<ul>\n	<li>Title: remove-authorized-keys</li>\n	<li>Discussion: We stated earlier that SSH is a great way to access a command line for a remote system securely and easily. But SSH access can get even easier - by using SSL key pairs. When a user generates an SSL key pair, they can choose to paste the contens of their public certificate into the /etc/ssh/keys-root/authorized_keys directory. When they open an SSH session, the ESXi host will issue a challenge encrypted with the stored public key. If the user is on a comptuer that stores the matching private key, the challenge can be decrypted and the user is allowed to logon without entering a password. Monitor the authorized_keys file regularly to ensure that no one has added their public key as a trusted SSH key.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-392ADDE9-FD3B-49A2-BF64-4ACBB60EB149.html\">Official VMware documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title: Set a timeout for the ESXi Shell to automatically disable idle sessions after a predetermined period\n<ul>\n	<li>Title: set-shell-timeout</li>\n	<li>Discussion: SSH (even when normally disabled and used sparingly only for troubleshooting) should be configured to end idle sessions. This is the ESXi equivalent of a password-protected screensaver policy for sysadmin workstations.</li>\n	<li><a href=\"http://kb.vmware.com/kb/2004746\">Official VMware documentation</a></li>\n</ul>\n</li>\n</ul>','','','inherit','open','open','','6964-revision','','','2012-06-28 01:27:28','2012-06-28 01:27:28','',6964,'http://egroup.jasonmangone.com/6964-revision',0,'revision','',0),(6966,35,'2012-06-28 01:28:14','2012-06-28 01:28:14','<div>Welcome to day 4 as we blog our way through the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a>. We\'ve already covered the first 15 ESXi security checks in parts <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a>, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a> and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-3\">three</a>. Here are our five security checks for today:</div>\r\n<ul>\r\n	<li>Guideline Title: Disable SSH\r\n<ul>\r\n	<li>Title: disable-ssh</li>\r\n	<li>Discussion: We all know and love SSH. It\'s an ecrypted way to access a command line on a remote system. But the truth is that a stopped service is infinitely harder to exploit than a running service. SSH should only be enabled as necessary for troubleshooting and then should be stopped again.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-12E27BF3-3769-4665-8769-DA76C2BC9FFE.html\">Official VMware documentation<!--more--></a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Enable lockdown mode to restrict remote access\r\n<ul>\r\n	<li>Title: enable-lockdown-mode</li>\r\n	<li>Discussion: Lockdown mode is often incorrectly thought to be an extra layer of security for your ESXi hosts. What it really does is retrict who can login to the host and from where. Under normal vSphere operations, an ESXi host is managed by vCenter. However any user with the root password or a local account can connect directly to the host with the vSphere client. Since the root account it often known by more than one person, configuration changes made by \"root\" cannot be traced back to a specific individual. Lockdown modes restricts logins by all users from the vSphere client and from all users except root on the console. This forces all users to login to vCenter using Active Directory credentials in order to modify host settings and creates a record of who modified host settings and when. Note: root can still login to the local console when lockdown mode is enabled. This constitutes a change in behavior from previous versions of ESXi.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/1008077\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Do not provide root/administrator level access to CIM-based hardware monitoring tools or other 3rd party applications\r\n<ul>\r\n	<li>Title: limit-cim-access</li>\r\n	<li>Discussion: CIM modules are commonly used to monitor ESXi host hardware and are provided by vendors such as Cisco, Dell, and HP. These modules have the capability of creating additional users on ESXi hosts and these users should only be given necessary permissions for monitoring. Avoid granting root permissions if it can be avoided.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.cimsdk.smashpg.doc_50/CIM_SMASH_PG_Use_Cases.5.1.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Remove keys from SSH authorized_keys file\r\n<ul>\r\n	<li>Title: remove-authorized-keys</li>\r\n	<li>Discussion: We stated earlier that SSH is a great way to access a command line for a remote system securely and easily. But SSH access can get even easier - by using SSL key pairs. When a user generates an SSL key pair, they can choose to paste the contens of their public certificate into the /etc/ssh/keys-root/authorized_keys directory. When they open an SSH session, the ESXi host will issue a challenge encrypted with the stored public key. If the user is on a comptuer that stores the matching private key, the challenge can be decrypted and the user is allowed to logon without entering a password. Monitor the authorized_keys file regularly to ensure that no one has added their public key as a trusted SSH key.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-392ADDE9-FD3B-49A2-BF64-4ACBB60EB149.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Set a timeout for the ESXi Shell to automatically disable idle sessions after a predetermined period\r\n<ul>\r\n	<li>Title: set-shell-timeout</li>\r\n	<li>Discussion: SSH (even when normally disabled and used sparingly only for troubleshooting) should be configured to end idle sessions. This is the ESXi equivalent of a password-protected screensaver policy for sysadmin workstations.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/2004746\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>','','','inherit','open','open','','6964-revision-2','','','2012-06-28 01:28:14','2012-06-28 01:28:14','',6964,'http://egroup.jasonmangone.com/6964-revision-2',0,'revision','',0),(6967,35,'2012-06-28 01:28:19','2012-06-28 01:28:19','<div>Welcome to day 4 as we blog our way through the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a>. We\'ve already covered the first 15 ESXi security checks in parts <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a>, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a> and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-3\">three</a>. Here are our five security checks for today:</div>\r\n<ul>\r\n	<li>Guideline Title: Disable SSH\r\n<ul>\r\n	<li>Title: disable-ssh</li>\r\n	<li>Discussion: We all know and love SSH. It\'s an ecrypted way to access a command line on a remote system. But the truth is that a stopped service is infinitely harder to exploit than a running service. SSH should only be enabled as necessary for troubleshooting and then should be stopped again.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-12E27BF3-3769-4665-8769-DA76C2BC9FFE.html\">Official VMware documentation<!--more--></a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Enable lockdown mode to restrict remote access\r\n<ul>\r\n	<li>Title: enable-lockdown-mode</li>\r\n	<li>Discussion: Lockdown mode is often incorrectly thought to be an extra layer of security for your ESXi hosts. What it really does is retrict who can login to the host and from where. Under normal vSphere operations, an ESXi host is managed by vCenter. However any user with the root password or a local account can connect directly to the host with the vSphere client. Since the root account it often known by more than one person, configuration changes made by \"root\" cannot be traced back to a specific individual. Lockdown modes restricts logins by all users from the vSphere client and from all users except root on the console. This forces all users to login to vCenter using Active Directory credentials in order to modify host settings and creates a record of who modified host settings and when. Note: root can still login to the local console when lockdown mode is enabled. This constitutes a change in behavior from previous versions of ESXi.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/1008077\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Do not provide root/administrator level access to CIM-based hardware monitoring tools or other 3rd party applications\r\n<ul>\r\n	<li>Title: limit-cim-access</li>\r\n	<li>Discussion: CIM modules are commonly used to monitor ESXi host hardware and are provided by vendors such as Cisco, Dell, and HP. These modules have the capability of creating additional users on ESXi hosts and these users should only be given necessary permissions for monitoring. Avoid granting root permissions if it can be avoided.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.cimsdk.smashpg.doc_50/CIM_SMASH_PG_Use_Cases.5.1.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Remove keys from SSH authorized_keys file\r\n<ul>\r\n	<li>Title: remove-authorized-keys</li>\r\n	<li>Discussion: We stated earlier that SSH is a great way to access a command line for a remote system securely and easily. But SSH access can get even easier - by using SSL key pairs. When a user generates an SSL key pair, they can choose to paste the contens of their public certificate into the /etc/ssh/keys-root/authorized_keys directory. When they open an SSH session, the ESXi host will issue a challenge encrypted with the stored public key. If the user is on a comptuer that stores the matching private key, the challenge can be decrypted and the user is allowed to logon without entering a password. Monitor the authorized_keys file regularly to ensure that no one has added their public key as a trusted SSH key.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-392ADDE9-FD3B-49A2-BF64-4ACBB60EB149.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Set a timeout for the ESXi Shell to automatically disable idle sessions after a predetermined period\r\n<ul>\r\n	<li>Title: set-shell-timeout</li>\r\n	<li>Discussion: SSH (even when normally disabled and used sparingly only for troubleshooting) should be configured to end idle sessions. This is the ESXi equivalent of a password-protected screensaver policy for sysadmin workstations.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/2004746\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>','','','inherit','open','open','','6964-revision-3','','','2012-06-28 01:28:19','2012-06-28 01:28:19','',6964,'http://egroup.jasonmangone.com/6964-revision-3',0,'revision','',0),(6968,35,'2012-06-28 01:29:32','2012-06-28 01:29:32','<div>Welcome to day 4 as we blog our way through the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a>. We\'ve already covered the first 15 ESXi security checks in parts <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a>, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a> and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-3\">three</a>. Here are our five security checks for today:</div>\r\n<ul>\r\n	<li>Guideline Title: Disable SSH\r\n<ul>\r\n	<li>Title: disable-ssh</li>\r\n	<li>Discussion: We all know and love SSH. It\'s an ecrypted way to access a command line on a remote system. But the truth is that a stopped service is infinitely harder to exploit than a running service. SSH should only be enabled as necessary for troubleshooting and then should be stopped again.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-12E27BF3-3769-4665-8769-DA76C2BC9FFE.html\">Official VMware documentation<!--more--></a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Enable lockdown mode to restrict remote access\r\n<ul>\r\n	<li>Title: enable-lockdown-mode</li>\r\n	<li>Discussion: Lockdown mode is often incorrectly thought to be an extra layer of security for your ESXi hosts. What it really does is retrict who can login to the host and from where. Under normal vSphere operations, an ESXi host is managed by vCenter. However any user with the root password or a local account can connect directly to the host with the vSphere client. Since the root account it often known by more than one person, configuration changes made by \"root\" cannot be traced back to a specific individual. Lockdown modes restricts logins by all users from the vSphere client and from all users except root on the console. This forces all users to login to vCenter using Active Directory credentials in order to modify host settings and creates a record of who modified host settings and when. Note: root can still login to the local console when lockdown mode is enabled. This constitutes a change in behavior from previous versions of ESXi.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/1008077\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Do not provide root/administrator level access to CIM-based hardware monitoring tools or other 3rd party applications\r\n<ul>\r\n	<li>Title: limit-cim-access</li>\r\n	<li>Discussion: CIM modules are commonly used to monitor ESXi host hardware and are provided by vendors such as Cisco, Dell, and HP. These modules have the capability of creating additional users on ESXi hosts and these users should only be given necessary permissions for monitoring. Avoid granting root permissions if it can be avoided.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.cimsdk.smashpg.doc_50/CIM_SMASH_PG_Use_Cases.5.1.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Remove keys from SSH authorized_keys file\r\n<ul>\r\n	<li>Title: remove-authorized-keys</li>\r\n	<li>Discussion: We stated earlier that SSH is a great way to access a command line for a remote system securely and easily. But SSH access can get even easier - by using SSL key pairs. When a user generates an SSL key pair, they can choose to paste the contens of their public certificate into the /etc/ssh/keys-root/authorized_keys directory. When they open an SSH session, the ESXi host will issue a challenge encrypted with the stored public key. If the user is on a comptuer that stores the matching private key, the challenge can be decrypted and the user is allowed to logon without entering a password. Monitor the authorized_keys file regularly to ensure that no one has added their public key as a trusted SSH key.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-392ADDE9-FD3B-49A2-BF64-4ACBB60EB149.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Set a timeout for the ESXi Shell to automatically disable idle sessions after a predetermined period\r\n<ul>\r\n	<li>Title: set-shell-timeout</li>\r\n	<li>Discussion: SSH (even when normally disabled and used sparingly only for troubleshooting) should be configured to end idle sessions. This is the ESXi equivalent of a password-protected screensaver policy for sysadmin workstations.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/2004746\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 4','','inherit','open','open','','6964-revision-4','','','2012-06-28 01:29:32','2012-06-28 01:29:32','',6964,'http://egroup.jasonmangone.com/6964-revision-4',0,'revision','',0),(6969,35,'2012-06-27 04:23:26','2012-06-27 04:23:26','If you\'re just joining us, I\'m blogging my way through the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a>. The preceding posts, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a> and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a>, are also available. Today\'s post discusses self-signed certificates, the DCUI console, and the memorable ESXi shell. Let\'s dive in!\r\n<ul>\r\n	<li>Guideline Title: Enable SSL for NFC\r\n<ul>\r\n	<li>Title: enable-nfc-ssl</li>\r\n	<li>Discussion: NFC (Network File Copy) is used to copy or migrate VMs between ESXi hosts. The vulnerability being addressed here is network traffic sniffing. If an attacker sniffed NFC traffic as it was being used to ship an entire VM, they would get an effective duplicate of your entire virtual server. Normally turning SSL on here would be an easy decision to recommend, but in this case, VMware\'s guidance on this issue is that NFC over SSL between ESXi hosts \"has ... not been extensively tested and so may cause HA and other operations to fail in certain circumstances.\" Ouch. We\'ll keep our eye on this one and hope that NFC over SSL gets more testing in the future. In the meantime, make sure your vSphere management networks and VLANs are sufficiently isolated as a partial mitigation.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/2010332\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title:  Do not use default self-signed certificates for ESXi communication\r\n<ul>\r\n	<li>Title: esxi-no-self-signed-certs</li>\r\n	<li>Discussion: This hardening guidance is written towards vSphere, but it\'s always good guidance for any system that uses encryption, even plain ol\' Windows Remote Desktop! Wikipedia has a <a href=\"http://en.wikipedia.org/wiki/Man-in-the-middle_attack\">detailed explanation of man-in-the-middle attacks</a>, but here\'s the gist: whenever you choose to connect to a server with an unverified SSL certificate, you have no certainty that your encrypted SSL tunnel reaches all the way to the server you\'re talking to. It\'s possible that your traffic is being intercepted, decrypted, stored, re-encrypted, and sent to its destination - all without you or the server you\'re connecting to being aware your traffic was intercepted. Self-signed SSL certs are generic and hard to distinguish from each other. They also lose the benefit of having a Certificate Authority confirm the validity of the cert. The solution is always replace default/vendor certificates on all network endpoints with certs issued by a commercial or organizational Certificate Authority.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.solutions.doc_50/GUID-37AAEDFE-EF2E-45FC-B0C6-44841E4FB302.html\">VMware Official documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Prevent unintended use of dvfilter network APIs\r\n<ul>\r\n	<li>Title: verify-dvfilter-bind</li>\r\n	<li>Discussion: The dvfilter network APIs are part of the larger <a href=\"http://blogs.vmware.com/vcloud/2010/04/what-actually-is-vmsafe-and-the-vmsafe-api.html\">VMsafe API</a> and they allow VMware partners to develop virtual security appliances to control the behavior of guest virtual machines. These virtual appliances have the benefit of simplifying guest VM configuration while increasing the overall security of your environment. Some great examples of this include <a href=\"http://www.trendmicro.com/us/enterprise/cloud-solutions/deep-security/index.html\">Trend Micro Deep Security</a>, the <a href=\"http://www.cisco.com/en/US/products/ps11208/index.html\">Cisco Virtual Security Gateway</a>, and the <a href=\"http://www.juniper.net/us/en/products-services/software/security/vgw-series/\">Juniper Virtual Gateway</a>. These appliances allow you to manage firewalls around your VMs as easily as dragging and dropping VMs in vCenter, enabling secure VM isolation (e.g. \"DEV servers can\'t talk to PROD servers\") but without sacrificing any ease of management (one of the reasons we virtualized everything in the first place, right?) These virtual security appliances using the dvfilter APIs receive privileged access to other guest VM network traffic. If you\'re not using any security appliances that leverage these APIs, you\'ll want to confirm they\'re not in use to prevent a malicious VM from receiving the data instead.</li>\r\n	<li>Official VMware documentation is still TBD</li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Disable DCUI to prevent local administrative control\r\n<ul>\r\n	<li>Title: disable-dcui</li>\r\n	<li>Discussion: <strong>NOTE: This is only recommended by VMware for the most secure environments. </strong>The DCUI is the name of the service that runs the gray and yellow console screen we all see when we first install ESXi and then promptly forget exists. This service can be stopped (and configured to not auto-start) which prevents any operations from occurring at the console or over a KVM. Be very careful and know the impact of this change. If you misconfigure a vSwitch and knock your host management kernel port offline, there\'s no parachute to reset the host vSwitch and you might be reaching for an ESXi install disk.</li>\r\n	<li>Official VMware documentation is still TBD</li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Disable ESXi Shell unless needed for diagnostics or troubleshooting\r\n<ul>\r\n	<li>Title: disable-esxi-shell</li>\r\n	<li>Discussion: This is known by some as the ESXi command line, formerly known as Tech Support Mode. From an ESXi console, you can press Alt+F1 and login as root to access a BusyBox environment that looks and acts a bit like Linux but has full control over host operations. The ESXi Shell should be started as necessary through the vSphere console for troubleshooting purposes and remain stopped the rest of the time.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/1017910\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 3','','inherit','open','open','','6940-revision-12','','','2012-06-27 04:23:26','2012-06-27 04:23:26','',6940,'http://egroup.jasonmangone.com/6940-revision-12',0,'revision','',0),(6970,35,'2012-06-28 01:30:03','2012-06-28 01:30:03','<div>Welcome to day 4 as we blog our way through the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a>. We\'ve already covered the first 15 ESXi security checks in parts <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a>, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a> and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-3\">three</a>. Here are our five security checks for today:</div>\r\n<ul>\r\n	<li>Guideline Title: Disable SSH\r\n<ul>\r\n	<li>Title: disable-ssh</li>\r\n	<li>Discussion: We all know and love SSH. It\'s an ecrypted way to access a command line on a remote system. But the truth is that a stopped service is infinitely harder to exploit than a running service. SSH should only be enabled as necessary for troubleshooting and then should be stopped again.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-12E27BF3-3769-4665-8769-DA76C2BC9FFE.html\">Official VMware documentation<!--more--></a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Enable lockdown mode to restrict remote access\r\n<ul>\r\n	<li>Title: enable-lockdown-mode</li>\r\n	<li>Discussion: Lockdown mode is often incorrectly thought to be an extra layer of security for your ESXi hosts. What it really does is restrict who can login to the host and from where. Under normal vSphere operations, an ESXi host is managed by vCenter. However any user with the root password or a local account can connect directly to the host with the vSphere client. Since the root account it often known by more than one person, configuration changes made by \"root\" cannot be traced back to a specific individual. Lockdown modes restricts logins by all users from the vSphere client and from all users except root on the console. This forces all users to login to vCenter using Active Directory credentials in order to modify host settings and creates a record of who modified host settings and when. Note: root can still login to the local console when lockdown mode is enabled. This constitutes a change in behavior from previous versions of ESXi.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/1008077\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Do not provide root/administrator level access to CIM-based hardware monitoring tools or other 3rd party applications\r\n<ul>\r\n	<li>Title: limit-cim-access</li>\r\n	<li>Discussion: CIM modules are commonly used to monitor ESXi host hardware and are provided by vendors such as Cisco, Dell, and HP. These modules have the capability of creating additional users on ESXi hosts and these users should only be given necessary permissions for monitoring. Avoid granting root permissions if it can be avoided.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.cimsdk.smashpg.doc_50/CIM_SMASH_PG_Use_Cases.5.1.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Remove keys from SSH authorized_keys file\r\n<ul>\r\n	<li>Title: remove-authorized-keys</li>\r\n	<li>Discussion: We stated earlier that SSH is a great way to access a command line for a remote system securely and easily. But SSH access can get even easier - by using SSL key pairs. When a user generates an SSL key pair, they can choose to paste the contens of their public certificate into the /etc/ssh/keys-root/authorized_keys directory. When they open an SSH session, the ESXi host will issue a challenge encrypted with the stored public key. If the user is on a comptuer that stores the matching private key, the challenge can be decrypted and the user is allowed to logon without entering a password. Monitor the authorized_keys file regularly to ensure that no one has added their public key as a trusted SSH key.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-392ADDE9-FD3B-49A2-BF64-4ACBB60EB149.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Set a timeout for the ESXi Shell to automatically disable idle sessions after a predetermined period\r\n<ul>\r\n	<li>Title: set-shell-timeout</li>\r\n	<li>Discussion: SSH (even when normally disabled and used sparingly only for troubleshooting) should be configured to end idle sessions. This is the ESXi equivalent of a password-protected screensaver policy for sysadmin workstations.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/2004746\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 4','','inherit','open','open','','6964-revision-5','','','2012-06-28 01:30:03','2012-06-28 01:30:03','',6964,'http://egroup.jasonmangone.com/6964-revision-5',0,'revision','',0),(6971,35,'2012-06-28 01:30:49','2012-06-28 01:30:49','If you\'re just joining us, I\'m blogging my way through the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a>. The preceding posts, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a> and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a>, are also available. Today\'s post discusses self-signed certificates, the DCUI console, and the memorable ESXi shell. Let\'s dive in!\r\n<ul>\r\n	<li>Guideline Title: Enable SSL for NFC\r\n<ul>\r\n	<li>Title: enable-nfc-ssl</li>\r\n	<li>Discussion: NFC (Network File Copy) is used to copy or migrate VMs between ESXi hosts. The vulnerability being addressed here is network traffic sniffing. If an attacker sniffed NFC traffic as it was being used to ship an entire VM, they would get an effective duplicate of your entire virtual server. Normally turning SSL on here would be an easy decision to recommend, but in this case, VMware\'s guidance on this issue is that NFC over SSL between ESXi hosts \"has ... not been extensively tested and so may cause HA and other operations to fail in certain circumstances.\" Ouch. We\'ll keep our eye on this one and hope that NFC over SSL gets more testing in the future. In the meantime, make sure your vSphere management networks and VLANs are sufficiently isolated as a partial mitigation.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/2010332\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title:  Do not use default self-signed certificates for ESXi communication\r\n<ul>\r\n	<li>Title: esxi-no-self-signed-certs</li>\r\n	<li>Discussion: This hardening guidance is written towards vSphere, but it\'s always good guidance for any system that uses encryption, even plain ol\' Windows Remote Desktop! Wikipedia has a <a href=\"http://en.wikipedia.org/wiki/Man-in-the-middle_attack\">detailed explanation of man-in-the-middle attacks</a>, but here\'s the gist: whenever you choose to connect to a server with an unverified SSL certificate, you have no certainty that your encrypted SSL tunnel reaches all the way to the server you\'re talking to. It\'s possible that your traffic is being intercepted, decrypted, stored, re-encrypted, and sent to its destination - all without you or the server you\'re connecting to being aware your traffic was intercepted. Self-signed SSL certs are generic and hard to distinguish from each other. They also lose the benefit of having a Certificate Authority confirm the validity of the cert. The solution is always replace default/vendor certificates on all network endpoints with certs issued by a commercial or organizational Certificate Authority.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.solutions.doc_50/GUID-37AAEDFE-EF2E-45FC-B0C6-44841E4FB302.html\">VMware Official documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Prevent unintended use of dvfilter network APIs\r\n<ul>\r\n	<li>Title: verify-dvfilter-bind</li>\r\n	<li>Discussion: The dvfilter network APIs are part of the larger <a href=\"http://blogs.vmware.com/vcloud/2010/04/what-actually-is-vmsafe-and-the-vmsafe-api.html\">VMsafe API</a> and they allow VMware partners to develop virtual security appliances to control the behavior of guest virtual machines. These virtual appliances have the benefit of simplifying guest VM configuration while increasing the overall security of your environment. Some great examples of this include <a href=\"http://www.trendmicro.com/us/enterprise/cloud-solutions/deep-security/index.html\">Trend Micro Deep Security</a>, the <a href=\"http://www.cisco.com/en/US/products/ps11208/index.html\">Cisco Virtual Security Gateway</a>, and the <a href=\"http://www.juniper.net/us/en/products-services/software/security/vgw-series/\">Juniper Virtual Gateway</a>. These appliances allow you to manage firewalls around your VMs as easily as dragging and dropping VMs in vCenter, enabling secure VM isolation (e.g. \"DEV servers can\'t talk to PROD servers\") but without sacrificing any ease of management (one of the reasons we virtualized everything in the first place, right?) These virtual security appliances using the dvfilter APIs receive privileged access to other guest VM network traffic. If you\'re not using any security appliances that leverage these APIs, you\'ll want to confirm they\'re not in use to prevent a malicious VM from receiving the data instead.</li>\r\n	<li>Official VMware documentation is still TBD</li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Disable DCUI to prevent local administrative control\r\n<ul>\r\n	<li>Title: disable-dcui</li>\r\n	<li>Discussion: <strong>NOTE: This is only recommended by VMware for the most secure environments. </strong>The DCUI is the name of the service that runs the gray and yellow console screen we all see when we first install ESXi and then promptly forget exists. This service can be stopped (and configured to not auto-start) which prevents any operations from occurring at the console or over a KVM. Be very careful and know the impact of this change. If you misconfigure a vSwitch and knock your host management kernel port offline, there\'s no parachute to reset the host vSwitch and you might be reaching for an ESXi install disk.</li>\r\n	<li>Official VMware documentation is still TBD</li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Disable ESXi Shell unless needed for diagnostics or troubleshooting\r\n<ul>\r\n	<li>Title: disable-esxi-shell</li>\r\n	<li>Discussion: This is known by some as the ESXi command line, formerly known as Tech Support Mode. From an ESXi console, you can press Alt+F1 and login as root to access a BusyBox environment that looks and acts a bit like Linux but has full control over host operations. The ESXi Shell should be started as necessary through the vSphere console for troubleshooting purposes and remain stopped the rest of the time.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/1017910\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 3','','inherit','open','open','','6940-revision-13','','','2012-06-28 01:30:49','2012-06-28 01:30:49','',6940,'http://egroup.jasonmangone.com/6940-revision-13',0,'revision','',0),(6972,35,'2012-06-28 02:04:19','2012-06-28 02:04:19','<div>Welcome to day 4 as we blog our way through the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a>. We\'ve already covered the first 15 ESXi security checks in parts <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a>, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a> and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-3\">three</a>. Here are our five security checks for today:</div>\n<ul>\n	<li>Guideline Title: Disable SSH\n<ul>\n	<li>Title: disable-ssh</li>\n	<li>Discussion: We all know and love SSH. It\'s an encrypted way to access a command line on a remote system. But the truth is that a stopped service is infinitely harder to exploit than a running service. SSH should only be enabled as necessary for troubleshooting and then should be stopped again.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-12E27BF3-3769-4665-8769-DA76C2BC9FFE.html\">Official VMware documentation<!--more--></a></li>\n</ul>\n</li>\n	<li>Guideline Title: Enable lockdown mode to restrict remote access\n<ul>\n	<li>Title: enable-lockdown-mode</li>\n	<li>Discussion: Lockdown mode is often incorrectly thought to be an extra layer of security for your ESXi hosts. What it really does is restrict who can login to the host and from where. Under normal vSphere operations, an ESXi host is managed by vCenter. However any user with the root password or a local account can connect directly to the host with the vSphere client. Since the root account it often known by more than one person, configuration changes made by \"root\" cannot be traced back to a specific individual. Lockdown modes restricts logins by all users from the vSphere client and from all users except root on the console. This forces all users to login to vCenter using Active Directory credentials in order to modify host settings and creates a record of who modified host settings and when. Note: root can still login to the local console when lockdown mode is enabled. This constitutes a change in behavior from previous versions of ESXi.</li>\n	<li><a href=\"http://kb.vmware.com/kb/1008077\">Official VMware documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title: Do not provide root/administrator level access to CIM-based hardware monitoring tools or other 3rd party applications\n<ul>\n	<li>Title: limit-cim-access</li>\n	<li>Discussion: CIM modules are commonly used to monitor ESXi host hardware and are provided by vendors such as Cisco, Dell, and HP. These modules have the capability of creating additional users on ESXi hosts and these users should only be given necessary permissions for monitoring. Avoid granting root permissions if it can be avoided.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.cimsdk.smashpg.doc_50/CIM_SMASH_PG_Use_Cases.5.1.html\">Official VMware documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title: Remove keys from SSH authorized_keys file\n<ul>\n	<li>Title: remove-authorized-keys</li>\n	<li>Discussion: We stated earlier that SSH is a great way to access a command line for a remote system securely and easily. But SSH access can get even easier - by using SSL key pairs. When a user generates an SSL key pair, they can choose to paste the contents of their public certificate into the /etc/ssh/keys-root/authorized_keys directory. When they open an SSH session, the ESXi host will issue a challenge encrypted with the stored public key. If the user is on a computer that stores the matching private key, the challenge can be decrypted and the user is allowed to logon without entering a password. Monitor the authorized_keys file regularly to ensure that no one has added their public key as a trusted SSH key.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-392ADDE9-FD3B-49A2-BF64-4ACBB60EB149.html\">Official VMware documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title: Set a timeout for the ESXi Shell to automatically disable idle sessions after a predetermined period\n<ul>\n	<li>Title: set-shell-timeout</li>\n	<li>Discussion: SSH (even when normally disabled and used sparingly only for troubleshooting) should be configured to end idle sessions. This is the ESXi equivalent of a password-protected screensaver policy for sysadmin workstations.</li>\n	<li><a href=\"http://kb.vmware.com/kb/2004746\">Official VMware documentation</a></li>\n</ul>\n</li>\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 4','','inherit','open','open','','6964-autosave','','','2012-06-28 02:04:19','2012-06-28 02:04:19','',6964,'http://egroup.jasonmangone.com/6964-autosave',0,'revision','',0),(6973,35,'2012-06-28 01:30:56','2012-06-28 01:30:56','<div>Welcome to day 4 as we blog our way through the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a>. We\'ve already covered the first 15 ESXi security checks in parts <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a>, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a> and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-3\">three</a>. Here are our five security checks for today:</div>\r\n<ul>\r\n	<li>Guideline Title: Disable SSH\r\n<ul>\r\n	<li>Title: disable-ssh</li>\r\n	<li>Discussion: We all know and love SSH. It\'s an ecrypted way to access a command line on a remote system. But the truth is that a stopped service is infinitely harder to exploit than a running service. SSH should only be enabled as necessary for troubleshooting and then should be stopped again.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-12E27BF3-3769-4665-8769-DA76C2BC9FFE.html\">Official VMware documentation<!--more--></a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Enable lockdown mode to restrict remote access\r\n<ul>\r\n	<li>Title: enable-lockdown-mode</li>\r\n	<li>Discussion: Lockdown mode is often incorrectly thought to be an extra layer of security for your ESXi hosts. What it really does is restrict who can login to the host and from where. Under normal vSphere operations, an ESXi host is managed by vCenter. However any user with the root password or a local account can connect directly to the host with the vSphere client. Since the root account it often known by more than one person, configuration changes made by \"root\" cannot be traced back to a specific individual. Lockdown modes restricts logins by all users from the vSphere client and from all users except root on the console. This forces all users to login to vCenter using Active Directory credentials in order to modify host settings and creates a record of who modified host settings and when. Note: root can still login to the local console when lockdown mode is enabled. This constitutes a change in behavior from previous versions of ESXi.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/1008077\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Do not provide root/administrator level access to CIM-based hardware monitoring tools or other 3rd party applications\r\n<ul>\r\n	<li>Title: limit-cim-access</li>\r\n	<li>Discussion: CIM modules are commonly used to monitor ESXi host hardware and are provided by vendors such as Cisco, Dell, and HP. These modules have the capability of creating additional users on ESXi hosts and these users should only be given necessary permissions for monitoring. Avoid granting root permissions if it can be avoided.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.cimsdk.smashpg.doc_50/CIM_SMASH_PG_Use_Cases.5.1.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Remove keys from SSH authorized_keys file\r\n<ul>\r\n	<li>Title: remove-authorized-keys</li>\r\n	<li>Discussion: We stated earlier that SSH is a great way to access a command line for a remote system securely and easily. But SSH access can get even easier - by using SSL key pairs. When a user generates an SSL key pair, they can choose to paste the contens of their public certificate into the /etc/ssh/keys-root/authorized_keys directory. When they open an SSH session, the ESXi host will issue a challenge encrypted with the stored public key. If the user is on a comptuer that stores the matching private key, the challenge can be decrypted and the user is allowed to logon without entering a password. Monitor the authorized_keys file regularly to ensure that no one has added their public key as a trusted SSH key.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-392ADDE9-FD3B-49A2-BF64-4ACBB60EB149.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Set a timeout for the ESXi Shell to automatically disable idle sessions after a predetermined period\r\n<ul>\r\n	<li>Title: set-shell-timeout</li>\r\n	<li>Discussion: SSH (even when normally disabled and used sparingly only for troubleshooting) should be configured to end idle sessions. This is the ESXi equivalent of a password-protected screensaver policy for sysadmin workstations.</li>\r\n	<li><a href=\"http://kb.vmware.com/kb/2004746\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 4','','inherit','open','open','','6964-revision-6','','','2012-06-28 01:30:56','2012-06-28 01:30:56','',6964,'http://egroup.jasonmangone.com/6964-revision-6',0,'revision','',0),(6975,44,'2012-06-16 20:12:09','2012-06-16 20:12:09','So for the guys out there who have read a few of my blogs, they know that before I came to eGroup I spent 11 years on the customer facing side of IT, administering storage, VMware, Citrix, etc.. One of my roles during that time period was also managing antivirus on desktops and servers, a fairly critical task because no one wants to have a major virus outbreak. It was never a fun task though, DATs were a pain, so was versioning, and hoping that it was working and that it was actually updating never made you feel good! Well, as I made the jump to my new career at eGroup I had my eyes opened to a new world of technology that I had not been exposed to previously, one of those was Trend Micro\'s Deep Security. As a VMware administrator I played around with different antivirus solutions trying to find one that didn\'t impact CPU utilization on my hosts and virtual machines severely, if it was an antivirus solution I tried it at least once and yet all of them seemed to impact my VM\'s CPU ranging from about 10% to sometimes closer to 30%. I always thought this was ridiculous and that there had to be a better way, well apparently the guys at Trend thought so as well and came up with a solution. Read more after the bump to see how it works!<!--more-->\r\n\r\nHave you ever put any thought into how to protect your hosts? Most people haven\'t they load antivirus on their virtual machines and go about their day, never thinking that their hosts could be hacked or infected. At the end of the day if that were to happen the trickledown effect would take down everything on that host and most likely other hosts with it. Deep Security stops this problem! By protecting VM\'s at the host level and removing \"traditional\" agents from your virtual servers and desktops you know that from the top down you are good to go. Remember that performance hit we were talking about earlier? Yeah it\'s gone!\r\n\r\nWhat does this mean to you? Well, a couple things... First off your virtual desktops and servers are now performing better, in fact you may be able to remove a CPU from some of your VM\'s. Additionally if you are a large enough shop and you shave off 15% CPU utilization off of every VM you have you may be able to remove a host or two, paving the way for further consolidation! It doesn\'t just end at antivirus either Deep Security has a myriad of protection underneath its hood that you can choose from. See below.\r\n\r\n-Anti- Malware Protection for VMware\r\n\r\n-Intrusion Detection and Prevention\r\n\r\n-Application Control\r\n\r\n-Integrity Monitoring\r\n\r\n-Web Application Protection\r\n\r\n-Log Inspection\r\n\r\nThe reality is many people have additional software or even hardware to take care of some of these items, with Deep Security you can remove that and leverage its maximum functionality and be closer to a truly virtualized \"cloud\" model. If you find any of this intriguing I would highly recommend you take a look <a href=\"http://www.trendmicro.com/cloud-content/us/pdfs/business/white-papers/wp_changing-the-game-for-antivirus-vmware.pdf\" target=\"_blank\">here</a> and read this <a href=\"http://www.trendmicro.com/cloud-content/us/pdfs/business/white-papers/wp_changing-the-game-for-antivirus-vmware.pdf\" target=\"_blank\">whitepaper</a>. It details all the inner workings and how it can help your VMware environment!\r\n\r\nBefore I close out if you take a look below you can check out the following diagram and it shows a great depiction of how Deep Security is laid out!\r\n\r\n<a href=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/deepsecurity.jpg\"><img class=\"aligncenter size-full wp-image-6829\" src=\"http://egroup.jasonmangone.com/wp-content/uploads/2012/06/deepsecurity.jpg\" alt=\"\" width=\"576\" height=\"327\" /></a>\r\n\r\n&nbsp;','SHOULDN\'T YOU BE RUNNING TREND MICRO\'S DEEP SECURITY?','','inherit','open','open','','6828-revision-3','','','2012-06-16 20:12:09','2012-06-16 20:12:09','',6828,'http://egroup.jasonmangone.com/6828-revision-3',0,'revision','',0),(7018,2,'2012-07-06 17:54:37','2012-07-06 17:54:37','Media Contact:\r\nLiz Wilmes\r\n843.284.0146 x9012\r\n<a href=\"mailto:Elizabeth.Wilmes@eGroup-us.com\">Elizabeth.Wilmes@eGroup-us.com</a>\r\n\r\nMt. Pleasant, SC – July 6, 2012 — <a href=\"http://www.eGroup-us.com\">eGroup, Inc</a>., the Southeast’s leading provider of <a href=\"http://egroup.jasonmangone.com/what-we-do/services/cloud-services\">cloud</a>, <a href=\"http://egroup.jasonmangone.com/what-we-do/services/application-services\">application</a> and <a href=\"http://egroup.jasonmangone.com/what-we-do/services/end-user-computing\">end-user computing</a> services, today announced that it has successfully completed the IaaS solution competency. This achievement demonstrates that eGroup is committed to be an expert in helping customers virtualize their IT environments. Further, in achieving this competency, eGroup acknowledges that this distinction and VMware solutions are key accelerators for enabling their growth in the virtualization and cloud markets.<!--more-->\r\n\r\n“VMware is pleased to recognize eGroup for achieving the IaaS solution competency. Achieving this competency demonstrates to customers that eGroup is committed to be an expert in helping customers virtualize their IT environments, enabling them to confidently select eGroup as a solution provider capable of delivering VMware solutions to customers on the journey to cloud computing,” said Doug Smith, vice president, global partner strategy and operations, VMware. “We value our partnership with eGroup and we appreciate their efforts in achieving this VMware distinction.”\r\n\r\n“Completion of the VMware IaaS competency is an important component of our market leadership goal in the cloud computing space,” said eGroup Principal Mike Carter. “IaaS is a critical component of our <a href=\"http://www.myecloud.com/\">eCloud</a> offering, which enables us to deliver efficient, flexible and cost-effective ways for IT departments to meet escalating business needs.”\r\n\r\nVMware has established solution competencies as designations of expertise that enable customers to identify partners with the highest level of VMware technical solution knowledge and experience. VMware partners with competencies are able to earn customer credibility by driving deeper into customer engagements, based on knowledge and ability with the following VMware solution competencies:\r\n\r\nInfrastructure Virtualization Competency: Recognizes partners for their demonstrated ability to virtualize and consolidate server environments using a VMware virtualization solution\r\n\r\nBusiness Continuity Competency: Recognizes partners for their expertise in deploying VMware solutions for data protection, high availability and disaster recovery\r\n\r\nDesktop Virtualization Competency: Recognizes partners for their expertise in deploying VMware solutions for virtualizing desktops and applications\r\n\r\nVirtualization of Business Critical Applications (VBCA) Competency: Recognizes partners for their demonstrated ability to provide guidance and solutions for virtualizing business-critical applications such as Exchange, SQL, SharePoint, Oracle DB and SAP\r\n\r\nInfrastructure as a Service (IaaS) Competency: Recognizes partners for their expertise in VMware hybrid cloud solutions and services\r\n\r\nManagement Competency: Recognizes partners for their ability to help customers simplify and automate the operations of virtual and cloud environments with the VMware vCenter™ Operations Management Suite\r\n\r\nVMware Partner Network is a comprehensive program that provides a common infrastructure, extensive sales and services tools, margin opportunities and industry-recognized training for the entire VMware partner ecosystem, including solution providers, technology partners and original equipment manufacturers (OEMs). VMware Partner Network is designed to help ensure a more consistent and successful user experience as well as help partners increase their business potential by increasing their skills in VMware solutions. The program helps partners maximize their investments in VMware virtualization to provide customers with the best end-to-end virtualization solutions available.\r\n\r\n<a href=\"http://www.vmware.com/partners/programs/\">Read more about VMware Partner Network.</a>\r\n\r\nAbout eGroup\r\n\r\nHeadquartered in Mt. Pleasant, S.C., eGroup provides innovative cloud, application and end-user computing services to businesses across the Southeast. One of the region’s fastest growing companies and winner of the 2012 CRN “Tech Elite 250”, eGroup’s solutions drive customer revenue while reducing cost to maintain IT infrastructures. Visit <a href=\"http://www.eGroup-us.com\">www.eGroup-us.com</a> or call 1.877.eGROUP.1 (1.877.347.6871) for more information.\r\n\r\n# # #\r\n\r\nVMware is a registered trademark and/or trademark of VMware, Inc. in the United States and/or other jurisdictions. The use of the term “partner” or “partnership” does not imply a legal partnership relationship between VMware and any other company.\r\n\r\n&nbsp;','eGROUP, INC. ACHIEVES VMWARE SOLUTION COMPETENCY IN IaaS','','publish','open','open','','egroup-inc-achieves-vmware-solution-competency-in-iaas','','','2012-07-06 17:55:44','2012-07-06 17:55:44','',0,'http://egroup.jasonmangone.com/?p=7018',0,'post','',0),(6979,24,'2012-06-29 01:22:43','2012-06-29 01:22:43','I was reading through the latest announcements from Cisco and I thought this was cool.  It is a new cloud platform on the Linksys Smart Wi-Fi Routers that \"..simplifies how consumers connect, control and interact with their connected devices, including personal entertainment and home appliances\".  Its a cool read and I think one of the best features is that they are creating a new Linksys developer community\r\n\r\n\"Cisco also announced the opening of its Linksys Developer Community to assist app developers interested in working with Cisco to expand the Cisco Connect Cloud home network platform for Linksys Smart Wi-Fi Routers. More information can be found at here and at http://developer.cisco.com/web/ldc.\"\r\n\r\nAllowing third parties to create apps for the home network could take the home network in a direction not seen before.  Read more here:\r\n\r\nhttp://newsroom.cisco.com/press-release-content?type=webcontent&amp;articleId=926061','Cisco announces new cloud platform for Linksys home routers','','publish','open','open','','cisco-announces-new-cloud-platform-for-linksys-home-routers','','','2012-06-29 01:24:12','2012-06-29 01:24:12','',0,'http://egroup.jasonmangone.com/?p=6979',0,'post','',0),(6980,24,'2012-06-29 01:21:52','2012-06-29 01:21:52','I was reading through the latest announcements from Cisco and I thought this was cool.  It is a new cloud platform on the Linksys Smart Wi-Fi Routers that \"..simplifies how consumers connect, control and interact with their connected devices, including personal entertainment and home appliances\".  Its a cool read and I think one of the best features is that they are creating a new Linksys developer community\n\n\"Cisco also announced the opening of its Linksys Developer Community to assist app developers interested in working with Cisco to expand the Cisco Connect Cloud home network platform for Linksys Smart Wi-Fi Routers. More information can be found at here and at http://developer.cisco.com/web/ldc.\"\n\nAllowing third parties to cre','Cisco announces new cloud platform for Linksys home routers','','inherit','open','open','','6979-revision','','','2012-06-29 01:21:52','2012-06-29 01:21:52','',6979,'http://egroup.jasonmangone.com/6979-revision',0,'revision','',0),(6982,35,'2012-06-29 08:00:27','2012-06-29 08:00:27','Welcome to our last discussion on the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a> of the week. Here are links to the past articles from the week: <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a>, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a>, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-3\">three</a>, and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-4\">four</a>.\r\n<ul>\r\n	<li>Guideline Title: Verify contents of exposed configuration files\r\n<ul>\r\n	<li>Title: verify-config-files</li>\r\n	<li>Discussion: Certain configuration files exist on ESXi hosts that govern host behavior and operations. These files should be logged and monitored for both authorized and unauthorized configuration changes. These files can be retrieved over HTTPS via http://&lt;hostname&gt;/host if the Managed Object Browser (MOB) is enabled. However, a separate VMware hardening recommendation we\'ve previously covered advises that the MOB be disabled. If your organization chooses not to accept the risk of leaving the MOB enabled, these configuration files can also be retrieved via vCLI or PowerCLI.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_hosts.4.4.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Keep ESXi system properly patched\r\n<ul>\r\n	<li>Title: apply-patches</li>\r\n	<li>Discussion: ESXi is designed from the ground up to be a powerful but secure hypervisor with minimal attack surface area. A complete install disc is less than 300MB. ESXi needs patches much less frequently than ESX used to, but it does still need them. VMware Update Manager is a free tool included with vCenter to help automate the patching of ESXi hosts during production hours with no VM downtime. To stay on top of the latest VMware Security Advisories by email you can also subscribe <a href=\"http://www.vmware.com/security/advisories/\">here</a>.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.update_manager.doc_50/GUID-EF6BEE4C-4583-4A8C-81B9-5B074CA2E272.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>\r\nNote: I\'m collapsing the next three hardening guide checks into a single entry since they are almost identical. I will point out in the discussion section where they differ.\r\n<ul>\r\n	<li>Guideline Title: Verify Image Profile and VIB Acceptance Levels\r\n<ul>\r\n	<li>Title(s): (1) verify-acceptance-level-certified, (2) verify-acceptance-level-accepted, (3) verify-acceptance-level-supported</li>\r\n	<li>Discussion: vSphere Installation Bundles (VIBs) are files that can be used to extend ESXi functionality. They might perform functions such as enabling hardware status monitoring, adding new hardware drivers, or enabling third-party security virtual appliances. These VIBs can have one of four available acceptance levels: VMwareCertified, VMwareAccepted, PartnerSupported, and CommunitySupported. As their names imply, these four levels relate to the entity that tested and possibly certified the VIBs for use. When you configure the VIB Acceptance Level, you are instructing your ESXi hosts to only install VIBs that meet or exceed the specified level of support and testing.\r\n<ul>\r\n	<li>-VMwareCertified - these VIBs are created, tested, and signed by VMware. This is the recommended setting for environments hosting extremely sensitive data, including military environments authorized to handle classified data.</li>\r\n	<li>-VMwareAccepted - These VIBs are created by a VMware Partner but are tested and signed by VMware. This is the recommended setting for environments hosting sensitive data or those subject to stricter compliance requirements.</li>\r\n	<li>-PartnerSupported - These VIBs are created, tested, and signed by a certified VMware Partner. This is the recommended setting for all vSphere environments.</li>\r\n	<li>-CommunitySupported - These VIBs are neither supported nor digitally signed. CommunitySupported VIBs should not be installed on production vSphere environments.</li>\r\n</ul>\r\n</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.install.doc_50/GUID-56600593-EC2E-4125-B1A0-065BDD16CF2D.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 5','','publish','open','open','','vsphere-5-0-hardening-guide-discussion-part-5','','','2012-06-29 12:49:32','2012-06-29 12:49:32','',0,'http://egroup.jasonmangone.com/?p=6982',0,'post','',0),(6981,24,'2012-06-29 01:22:43','2012-06-29 01:22:43','I was reading through the latest announcements from Cisco and I thought this was cool.  It is a new cloud platform on the Linksys Smart Wi-Fi Routers that \"..simplifies how consumers connect, control and interact with their connected devices, including personal entertainment and home appliances\".  Its a cool read and I think one of the best features is that they are creating a new Linksys developer community\r\n\r\n\"Cisco also announced the opening of its Linksys Developer Community to assist app developers interested in working with Cisco to expand the Cisco Connect Cloud home network platform for Linksys Smart Wi-Fi Routers. More information can be found at here and at http://developer.cisco.com/web/ldc.\"\r\n\r\nAllowing third parties to create apps for the home network could take the home network in a direction not seen before.  Read more here:\r\n\r\nNew Linksys Developer Community Opens\r\n\r\nCisco also announced the opening of its Linksys Developer Community to assist app developers interested in working with Cisco to expand the Cisco Connect Cloud home network platform for Linksys Smart Wi-Fi Routers. More information can be found at here and at http://developer.cisco.com/web/ldc.','Cisco announces new cloud platform for Linksys home routers','','inherit','open','open','','6979-revision-2','','','2012-06-29 01:22:43','2012-06-29 01:22:43','',6979,'http://egroup.jasonmangone.com/6979-revision-2',0,'revision','',0),(6983,35,'2012-06-29 04:14:54','2012-06-29 04:14:54','Welcome to our last discussion on the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a> of the week. Here are links to the past articles from the week: <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a>, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a>, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-3\">three</a>, and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-4\">four</a>.\n<ul>\n	<li>Guideline Title: Verify contents of exposed configuration files\n<ul>\n	<li>Title: verify-config-files</li>\n	<li>Discussion: Certain configuration files exist on ESXi hosts that govern host behavior and operations. These files should be logged and monitored for both authorized and unauthorized configuration changes. These files can be retrieved over HTTPS via http://&lt;hostname&gt;/host if the Managed Object Browser (MOB) is enabled. However, a separate VMware hardening recommendation we\'ve previously covered advises that the MOB be disabled. If your organization chooses not to accept the risk of leaving the MOB enabled, these configuration files can also be retrieved via vCLI or PowerCLI.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_hosts.4.4.html\">Official VMware documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title: Keep ESXi system properly patched\n<ul>\n	<li>Title: apply-patches</li>\n	<li>Discussion: ESXi is designed from the ground up to be a powerful but secure hypervisor with minimal attack surface area. A complete install disc is less than 300MB. ESXi needs patches much less frequently than ESX used to, but it does still need them. VMware Update Manager is a free tool included with vCenter to help automate the patching of ESXi hosts during production hours with no VM downtime. To stay on top of the latest VMware Security Advisories by email you can subscribe here - http://www.vmware.com/security/advisories/</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.update_manager.doc_50/GUID-EF6BEE4C-4583-4A8C-81B9-5B074CA2E272.html\">Official VMware documentation</a></li>\n</ul>\n</li>\n</ul>\nNote: I\'m collapsing the next three hardening guide checks into a single entry since they are almost identical. I will point out in the discussion section where they differ.\n<ul>\n	<li>Guideline Title: Verify Image Profile and VIB Acceptance Levels\n<ul>\n	<li>Title(s): (1) verify-acceptance-level-certified, (2) verify-acceptance-level-accepted, (3) verify-acceptance-level-supported</li>\n	<li>Discussion: vSphere Installation Bundles (VIBs) are files that can be used to extend ESXi functionality. They might perform functions such as enabling hardware status monitoring, adding new hardware drivers, or enabling third-party security virtual appliances. These VIBs can have one of four available acceptance levels: VMwareCertified, VMwareAccepted, PartnerSupported, and CommunitySupported. As their names imply, these four levels relate to the entity that tested and possibly certified the VIBs for use. When you configure the VIB Acceptance Level, you are instructing your ESXi hosts to only install VIBs that meet or exceed the specified level of support and testing.\n<ul>\n	<li>-VMwareCertified - these VIBs are created, tested, and signed by VMware. This is the recommended setting for environments hosting extremely sensitive data, including military environments authorized to handle classified data.</li>\n	<li>-VMwareAccepted - These VIBs are created by a VMware Partner but are tested and signed by VMware. This is the recommended setting for environments hosting sensitive data or those subject to stricter compliance requirements.</li>\n	<li>-PartnerSupported - These VIBs are created, tested, and signed by a certified VMware Partner. This is the recommended setting for all vSphere environments.</li>\n	<li>-CommunitySupported - These VIBs are neither supported nor digitally signed. CommunitySupported VIBs should not be installed on production vSphere environments.</li>\n</ul>\n</li>\n	<li>Official VMware documentation http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.install.doc_50/GUID-56600593-EC2E-4125-B1A0-065BDD16CF2D.html</li>\n</ul>\n</li>\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 5','','inherit','open','open','','6982-revision','','','2012-06-29 04:14:54','2012-06-29 04:14:54','',6982,'http://egroup.jasonmangone.com/6982-revision',0,'revision','',0),(6984,35,'2012-06-29 04:15:34','2012-06-29 04:15:34','Welcome to our last discussion on the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a> of the week. Here are links to the past articles from the week: <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a>, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a>, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-3\">three</a>, and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-4\">four</a>.\r\n<ul>\r\n	<li>Guideline Title: Verify contents of exposed configuration files\r\n<ul>\r\n	<li>Title: verify-config-files</li>\r\n	<li>Discussion: Certain configuration files exist on ESXi hosts that govern host behavior and operations. These files should be logged and monitored for both authorized and unauthorized configuration changes. These files can be retrieved over HTTPS via http://&lt;hostname&gt;/host if the Managed Object Browser (MOB) is enabled. However, a separate VMware hardening recommendation we\'ve previously covered advises that the MOB be disabled. If your organization chooses not to accept the risk of leaving the MOB enabled, these configuration files can also be retrieved via vCLI or PowerCLI.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_hosts.4.4.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Keep ESXi system properly patched\r\n<ul>\r\n	<li>Title: apply-patches</li>\r\n	<li>Discussion: ESXi is designed from the ground up to be a powerful but secure hypervisor with minimal attack surface area. A complete install disc is less than 300MB. ESXi needs patches much less frequently than ESX used to, but it does still need them. VMware Update Manager is a free tool included with vCenter to help automate the patching of ESXi hosts during production hours with no VM downtime. To stay on top of the latest VMware Security Advisories by email you can subscribe <a href=\"http://www.vmware.com/security/advisories/\">here</a>.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.update_manager.doc_50/GUID-EF6BEE4C-4583-4A8C-81B9-5B074CA2E272.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>\r\nNote: I\'m collapsing the next three hardening guide checks into a single entry since they are almost identical. I will point out in the discussion section where they differ.\r\n<ul>\r\n	<li>Guideline Title: Verify Image Profile and VIB Acceptance Levels\r\n<ul>\r\n	<li>Title(s): (1) verify-acceptance-level-certified, (2) verify-acceptance-level-accepted, (3) verify-acceptance-level-supported</li>\r\n	<li>Discussion: vSphere Installation Bundles (VIBs) are files that can be used to extend ESXi functionality. They might perform functions such as enabling hardware status monitoring, adding new hardware drivers, or enabling third-party security virtual appliances. These VIBs can have one of four available acceptance levels: VMwareCertified, VMwareAccepted, PartnerSupported, and CommunitySupported. As their names imply, these four levels relate to the entity that tested and possibly certified the VIBs for use. When you configure the VIB Acceptance Level, you are instructing your ESXi hosts to only install VIBs that meet or exceed the specified level of support and testing.\r\n<ul>\r\n	<li>-VMwareCertified - these VIBs are created, tested, and signed by VMware. This is the recommended setting for environments hosting extremely sensitive data, including military environments authorized to handle classified data.</li>\r\n	<li>-VMwareAccepted - These VIBs are created by a VMware Partner but are tested and signed by VMware. This is the recommended setting for environments hosting sensitive data or those subject to stricter compliance requirements.</li>\r\n	<li>-PartnerSupported - These VIBs are created, tested, and signed by a certified VMware Partner. This is the recommended setting for all vSphere environments.</li>\r\n	<li>-CommunitySupported - These VIBs are neither supported nor digitally signed. CommunitySupported VIBs should not be installed on production vSphere environments.</li>\r\n</ul>\r\n</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.install.doc_50/GUID-56600593-EC2E-4125-B1A0-065BDD16CF2D.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 5','','inherit','open','open','','6982-revision-2','','','2012-06-29 04:15:34','2012-06-29 04:15:34','',6982,'http://egroup.jasonmangone.com/6982-revision-2',0,'revision','',0),(6985,35,'2012-06-29 04:15:36','2012-06-29 04:15:36','Welcome to our last discussion on the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a> of the week. Here are links to the past articles from the week: <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a>, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a>, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-3\">three</a>, and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-4\">four</a>.\r\n<ul>\r\n	<li>Guideline Title: Verify contents of exposed configuration files\r\n<ul>\r\n	<li>Title: verify-config-files</li>\r\n	<li>Discussion: Certain configuration files exist on ESXi hosts that govern host behavior and operations. These files should be logged and monitored for both authorized and unauthorized configuration changes. These files can be retrieved over HTTPS via http://&lt;hostname&gt;/host if the Managed Object Browser (MOB) is enabled. However, a separate VMware hardening recommendation we\'ve previously covered advises that the MOB be disabled. If your organization chooses not to accept the risk of leaving the MOB enabled, these configuration files can also be retrieved via vCLI or PowerCLI.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_hosts.4.4.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Keep ESXi system properly patched\r\n<ul>\r\n	<li>Title: apply-patches</li>\r\n	<li>Discussion: ESXi is designed from the ground up to be a powerful but secure hypervisor with minimal attack surface area. A complete install disc is less than 300MB. ESXi needs patches much less frequently than ESX used to, but it does still need them. VMware Update Manager is a free tool included with vCenter to help automate the patching of ESXi hosts during production hours with no VM downtime. To stay on top of the latest VMware Security Advisories by email you can subscribe <a href=\"http://www.vmware.com/security/advisories/\">here</a>.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.update_manager.doc_50/GUID-EF6BEE4C-4583-4A8C-81B9-5B074CA2E272.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>\r\nNote: I\'m collapsing the next three hardening guide checks into a single entry since they are almost identical. I will point out in the discussion section where they differ.\r\n<ul>\r\n	<li>Guideline Title: Verify Image Profile and VIB Acceptance Levels\r\n<ul>\r\n	<li>Title(s): (1) verify-acceptance-level-certified, (2) verify-acceptance-level-accepted, (3) verify-acceptance-level-supported</li>\r\n	<li>Discussion: vSphere Installation Bundles (VIBs) are files that can be used to extend ESXi functionality. They might perform functions such as enabling hardware status monitoring, adding new hardware drivers, or enabling third-party security virtual appliances. These VIBs can have one of four available acceptance levels: VMwareCertified, VMwareAccepted, PartnerSupported, and CommunitySupported. As their names imply, these four levels relate to the entity that tested and possibly certified the VIBs for use. When you configure the VIB Acceptance Level, you are instructing your ESXi hosts to only install VIBs that meet or exceed the specified level of support and testing.\r\n<ul>\r\n	<li>-VMwareCertified - these VIBs are created, tested, and signed by VMware. This is the recommended setting for environments hosting extremely sensitive data, including military environments authorized to handle classified data.</li>\r\n	<li>-VMwareAccepted - These VIBs are created by a VMware Partner but are tested and signed by VMware. This is the recommended setting for environments hosting sensitive data or those subject to stricter compliance requirements.</li>\r\n	<li>-PartnerSupported - These VIBs are created, tested, and signed by a certified VMware Partner. This is the recommended setting for all vSphere environments.</li>\r\n	<li>-CommunitySupported - These VIBs are neither supported nor digitally signed. CommunitySupported VIBs should not be installed on production vSphere environments.</li>\r\n</ul>\r\n</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.install.doc_50/GUID-56600593-EC2E-4125-B1A0-065BDD16CF2D.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 5','','inherit','open','open','','6982-revision-3','','','2012-06-29 04:15:36','2012-06-29 04:15:36','',6982,'http://egroup.jasonmangone.com/6982-revision-3',0,'revision','',0),(6986,35,'2012-06-29 04:17:28','2012-06-29 04:17:28','Welcome to our last discussion on the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a> of the week. Here are links to the past articles from the week: <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a>, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a>, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-3\">three</a>, and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-4\">four</a>.\n<ul>\n	<li>Guideline Title: Verify contents of exposed configuration files\n<ul>\n	<li>Title: verify-config-files</li>\n	<li>Discussion: Certain configuration files exist on ESXi hosts that govern host behavior and operations. These files should be logged and monitored for both authorized and unauthorized configuration changes. These files can be retrieved over HTTPS via http://&lt;hostname&gt;/host if the Managed Object Browser (MOB) is enabled. However, a separate VMware hardening recommendation we\'ve previously covered advises that the MOB be disabled. If your organization chooses not to accept the risk of leaving the MOB enabled, these configuration files can also be retrieved via vCLI or PowerCLI.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_hosts.4.4.html\">Official VMware documentation</a></li>\n</ul>\n</li>\n	<li>Guideline Title: Keep ESXi system properly patched\n<ul>\n	<li>Title: apply-patches</li>\n	<li>Discussion: ESXi is designed from the ground up to be a powerful but secure hypervisor with minimal attack surface area. A complete install disc is less than 300MB. ESXi needs patches much less frequently than ESX used to, but it does still need them. VMware Update Manager is a free tool included with vCenter to help automate the patching of ESXi hosts during production hours with no VM downtime. To stay on top of the latest VMware Security Advisories by email you can subscribe <a href=\"http://www.vmware.com/security/advisories/\">here</a>.</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.update_manager.doc_50/GUID-EF6BEE4C-4583-4A8C-81B9-5B074CA2E272.html\">Official VMware documentation</a></li>\n</ul>\n</li>\n</ul>\nNote: I\'m collapsing the next three hardening guide checks into a single entry since they are almost identical. I will point out in the discussion section where they differ.\n<ul>\n	<li>Guideline Title: Verify Image Profile and VIB Acceptance Levels\n<ul>\n	<li>Title(s): (1) verify-acceptance-level-certified, (2) verify-acceptance-level-accepted, (3) verify-acceptance-level-supported</li>\n	<li>Discussion: vSphere Installation Bundles (VIBs) are files that can be used to extend ESXi functionality. They might perform functions such as enabling hardware status monitoring, adding new hardware drivers, or enabling third-party security virtual appliances. These VIBs can have one of four available acceptance levels: VMwareCertified, VMwareAccepted, PartnerSupported, and CommunitySupported. As their names imply, these four levels relate to the entity that tested and possibly certified the VIBs for use. When you configure the VIB Acceptance Level, you are instructing your ESXi hosts to only install VIBs that meet or exceed the specified level of support and testing.\n<ul>\n	<li>-VMwareCertified - these VIBs are created, tested, and signed by VMware. This is the recommended setting for environments hosting extremely sensitive data, including military environments authorized to handle classified data.</li>\n	<li>-VMwareAccepted - These VIBs are created by a VMware Partner but are tested and signed by VMware. This is the recommended setting for environments hosting sensitive data or those subject to stricter compliance requirements.</li>\n	<li>-PartnerSupported - These VIBs are created, tested, and signed by a certified VMware Partner. This is the recommended setting for all vSphere environments.</li>\n	<li>-CommunitySupported - These VIBs are neither supported nor digitally signed. CommunitySupported VIBs should not be installed on production vSphere environments.</li>\n</ul>\n</li>\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.install.doc_50/GUID-56600593-EC2E-4125-B1A0-065BDD16CF2D.html\">Official VMware documentation</a></li>\n</ul>\n</li>\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 5','','inherit','open','open','','6982-revision-4','','','2012-06-29 04:17:28','2012-06-29 04:17:28','',6982,'http://egroup.jasonmangone.com/6982-revision-4',0,'revision','',0),(6987,35,'2012-06-29 04:17:31','2012-06-29 04:17:31','Welcome to our last discussion on the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a> of the week. Here are links to the past articles from the week: <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a>, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a>, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-3\">three</a>, and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-4\">four</a>.\r\n<ul>\r\n	<li>Guideline Title: Verify contents of exposed configuration files\r\n<ul>\r\n	<li>Title: verify-config-files</li>\r\n	<li>Discussion: Certain configuration files exist on ESXi hosts that govern host behavior and operations. These files should be logged and monitored for both authorized and unauthorized configuration changes. These files can be retrieved over HTTPS via http://&lt;hostname&gt;/host if the Managed Object Browser (MOB) is enabled. However, a separate VMware hardening recommendation we\'ve previously covered advises that the MOB be disabled. If your organization chooses not to accept the risk of leaving the MOB enabled, these configuration files can also be retrieved via vCLI or PowerCLI.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_hosts.4.4.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Keep ESXi system properly patched\r\n<ul>\r\n	<li>Title: apply-patches</li>\r\n	<li>Discussion: ESXi is designed from the ground up to be a powerful but secure hypervisor with minimal attack surface area. A complete install disc is less than 300MB. ESXi needs patches much less frequently than ESX used to, but it does still need them. VMware Update Manager is a free tool included with vCenter to help automate the patching of ESXi hosts during production hours with no VM downtime. To stay on top of the latest VMware Security Advisories by email you can subscribe <a href=\"http://www.vmware.com/security/advisories/\">here</a>.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.update_manager.doc_50/GUID-EF6BEE4C-4583-4A8C-81B9-5B074CA2E272.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>\r\nNote: I\'m collapsing the next three hardening guide checks into a single entry since they are almost identical. I will point out in the discussion section where they differ.\r\n<ul>\r\n	<li>Guideline Title: Verify Image Profile and VIB Acceptance Levels\r\n<ul>\r\n	<li>Title(s): (1) verify-acceptance-level-certified, (2) verify-acceptance-level-accepted, (3) verify-acceptance-level-supported</li>\r\n	<li>Discussion: vSphere Installation Bundles (VIBs) are files that can be used to extend ESXi functionality. They might perform functions such as enabling hardware status monitoring, adding new hardware drivers, or enabling third-party security virtual appliances. These VIBs can have one of four available acceptance levels: VMwareCertified, VMwareAccepted, PartnerSupported, and CommunitySupported. As their names imply, these four levels relate to the entity that tested and possibly certified the VIBs for use. When you configure the VIB Acceptance Level, you are instructing your ESXi hosts to only install VIBs that meet or exceed the specified level of support and testing.\r\n<ul>\r\n	<li>-VMwareCertified - these VIBs are created, tested, and signed by VMware. This is the recommended setting for environments hosting extremely sensitive data, including military environments authorized to handle classified data.</li>\r\n	<li>-VMwareAccepted - These VIBs are created by a VMware Partner but are tested and signed by VMware. This is the recommended setting for environments hosting sensitive data or those subject to stricter compliance requirements.</li>\r\n	<li>-PartnerSupported - These VIBs are created, tested, and signed by a certified VMware Partner. This is the recommended setting for all vSphere environments.</li>\r\n	<li>-CommunitySupported - These VIBs are neither supported nor digitally signed. CommunitySupported VIBs should not be installed on production vSphere environments.</li>\r\n</ul>\r\n</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.install.doc_50/GUID-56600593-EC2E-4125-B1A0-065BDD16CF2D.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 5','','inherit','open','open','','6982-revision-5','','','2012-06-29 04:17:31','2012-06-29 04:17:31','',6982,'http://egroup.jasonmangone.com/6982-revision-5',0,'revision','',0),(6988,35,'2012-06-29 04:18:07','2012-06-29 04:18:07','Welcome to our last discussion on the <a href=\"http://communities.vmware.com/docs/DOC-19605\">VMware vSphere 5.0 Hardening Guide</a> of the week. Here are links to the past articles from the week: <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1\">one</a>, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2\">two</a>, <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-3\">three</a>, and <a href=\"http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-4\">four</a>.\r\n<ul>\r\n	<li>Guideline Title: Verify contents of exposed configuration files\r\n<ul>\r\n	<li>Title: verify-config-files</li>\r\n	<li>Discussion: Certain configuration files exist on ESXi hosts that govern host behavior and operations. These files should be logged and monitored for both authorized and unauthorized configuration changes. These files can be retrieved over HTTPS via http://&lt;hostname&gt;/host if the Managed Object Browser (MOB) is enabled. However, a separate VMware hardening recommendation we\'ve previously covered advises that the MOB be disabled. If your organization chooses not to accept the risk of leaving the MOB enabled, these configuration files can also be retrieved via vCLI or PowerCLI.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_hosts.4.4.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n	<li>Guideline Title: Keep ESXi system properly patched\r\n<ul>\r\n	<li>Title: apply-patches</li>\r\n	<li>Discussion: ESXi is designed from the ground up to be a powerful but secure hypervisor with minimal attack surface area. A complete install disc is less than 300MB. ESXi needs patches much less frequently than ESX used to, but it does still need them. VMware Update Manager is a free tool included with vCenter to help automate the patching of ESXi hosts during production hours with no VM downtime. To stay on top of the latest VMware Security Advisories by email you can subscribe <a href=\"http://www.vmware.com/security/advisories/\">here</a>.</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.update_manager.doc_50/GUID-EF6BEE4C-4583-4A8C-81B9-5B074CA2E272.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>\r\nNote: I\'m collapsing the next three hardening guide checks into a single entry since they are almost identical. I will point out in the discussion section where they differ.\r\n<ul>\r\n	<li>Guideline Title: Verify Image Profile and VIB Acceptance Levels\r\n<ul>\r\n	<li>Title(s): (1) verify-acceptance-level-certified, (2) verify-acceptance-level-accepted, (3) verify-acceptance-level-supported</li>\r\n	<li>Discussion: vSphere Installation Bundles (VIBs) are files that can be used to extend ESXi functionality. They might perform functions such as enabling hardware status monitoring, adding new hardware drivers, or enabling third-party security virtual appliances. These VIBs can have one of four available acceptance levels: VMwareCertified, VMwareAccepted, PartnerSupported, and CommunitySupported. As their names imply, these four levels relate to the entity that tested and possibly certified the VIBs for use. When you configure the VIB Acceptance Level, you are instructing your ESXi hosts to only install VIBs that meet or exceed the specified level of support and testing.\r\n<ul>\r\n	<li>-VMwareCertified - these VIBs are created, tested, and signed by VMware. This is the recommended setting for environments hosting extremely sensitive data, including military environments authorized to handle classified data.</li>\r\n	<li>-VMwareAccepted - These VIBs are created by a VMware Partner but are tested and signed by VMware. This is the recommended setting for environments hosting sensitive data or those subject to stricter compliance requirements.</li>\r\n	<li>-PartnerSupported - These VIBs are created, tested, and signed by a certified VMware Partner. This is the recommended setting for all vSphere environments.</li>\r\n	<li>-CommunitySupported - These VIBs are neither supported nor digitally signed. CommunitySupported VIBs should not be installed on production vSphere environments.</li>\r\n</ul>\r\n</li>\r\n	<li><a href=\"http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.install.doc_50/GUID-56600593-EC2E-4125-B1A0-065BDD16CF2D.html\">Official VMware documentation</a></li>\r\n</ul>\r\n</li>\r\n</ul>','VSPHERE 5.0 HARDENING GUIDE DISCUSSION – PART 5','','inherit','open','open','','6982-revision-6','','','2012-06-29 04:18:07','2012-06-29 04:18:07','',6982,'http://egroup.jasonmangone.com/6982-revision-6',0,'revision','',0),