Welcome back to part 2 of our discussion of the vSphere 5.0 Hardening Guide! If you missed part 1, you can find it <a href="http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1">here</a>. Let's get back to it!
<ul>
	<li>Guideline Title: Communication Configure the ESXi host firewall to restrict access to services running on the host
<ul>
	<li>Title: config-firewall-access</li>
	<li>Discussion: The process of hardening a production server involves stopping unnecessary services and protecting services that need to remain running, and ESXi is no different. Unnecessary services should be disabled. Necessary services can be protected by defining allowed IPs that are allowed to connect. These IPs can be set under "Configuration -&gt; Security Profile -&gt; Firewall -&gt; Properties". Select a service then click "Firewall", choose "Only allow connections from the following networks" and specify the IPs or ranges that will be allowed to connect.
<a href="http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png"><img class="alignnone  wp-image-6923" src="http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png" alt="" width="374" height="236" /></a></li>
	<li><a href="http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-DD4322FF-3DC4-4716-8819-6688938F99D7.html">Official VMware Documentation</a></li>
</ul>
</li>
	<li>Guideline Title: Configure NTP time synchronization
<ul>
	<li>Title: config-ntp</li>
	<li>Discussion: NTP serves two purposes. First,  in the event of a security breach, having your ESXi system logs synchronized will lend itself to an effective incident postmortem, which can, in turn, help increase the security of your environment and further remediate vulnerabilities. Second,  NTP will be used by any VMs that utilize the VMware Tools time synchronization. When the host has accurate time, the VMs using it as a time source will also. I prefer to pick a single device inside the firewall (possibly the firewall itself) to serve as my internal NTP source. Then I have all my other hosts sync against that device. This means that if the internet connection goes down, only one system notices and the rest of the systems all stay in sync with each other, though not necessarily with the rest of the world. So set an NTP server choose "Configuration -&gt; Time Configuration -&gt; Options -&gt; start the NTP service and select "Start and stop with host"". Click 'Add' and specify your site's NTP servers.</li>
	<li>Official VMware documentation</li>
</ul>
</li>
	<li>config-snmp vSphere 5.0 ESXI Communication Ensure proper SNMP configuration If SNMP is not being used, it should remain disabled. If it is being used, the proper trap destination should be configured. If SNMP is not properly configured, monitoring information can be sent to a malicious host that can then use this information to plan an attack. 1,2,3 Parameter Run "vicfg-snmp &lt;conn_options&gt; --show" to determine if SNMP is being used. If SNMP is not being used, make sure that it is not running: "vicfg-snmp &lt;conn_options&gt; --disable&gt;. If SNMP is being used, refer to the vSphere Command-Line Interface Concepts and Examples guide, Chapter 10 for steps to make sure the parameters are properly configured. SNMP must be configured on each ESXi host using either vCLI or PowerCLI, or using an API client. /etc/vmware/snmp.xml N/A site-specific Modify N/A http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.monitoring.doc_50/GUID-8EF36D7D-59B6-4C74-B1AA-4A9D18AB6250.html</li>
	<li>disable-mob vSphere 5.0 ESXI Communication Disable Managed Object Browser (MOB) The managed object browser (MOB) provides a way to explore the object model used by the VMkernel to manage the host; it enables configurations to be changed as well. This interface is meant to be used primarily for debugging the vSphere SDK but because there are no access controls it could also be used as a method obtain information about a host being targeted for unauthorized access. 1,2,3 Parameter To determine if the MOB is enabled run the following command on the ESXi shell: ~# vim-cmd proxysvc/service_list. To disable the MOB run the following command: ~# vim-cmd proxysvc/remove_service "/mob" "httpsWithRedirect". Note: You cannot disable MOB while in lockdown mode. N/A N/A Remove Service Remove No The MOB will no longer be available for diagnostics. Some 3rd party tools use this interface to gather information. Testing should be done after disabling the MOB to verify 3rd party applications are still functioning as expected. To re-enable the MOB: ~ # vim-cmd proxysvc/add_np_service "/mob" httpsWithRedirect /var/run/vmware/proxy-mob http://kb.vmware.com/kb/1016039</li>
	<li>enable-auth-proxy vSphere 5.0 ESXI Communication When adding ESXi hosts to Active Directory use the vSphere Authentication Proxy to protect passwords If you configure your host to join an Active Directory domain using host profiles, the passwords used to authenticate the host are not protected. To avoid transmitting clear text passwords use the vSphere Authentication Proxy to configure hosts in Active Directory. 1,2,3 Parameter From the vSphere client home page select "Host Profiles". Right click the Host Profile and select Edit. Choose "Authentication configuration -&gt; Active Directory Configuration -&gt; Join Domain Method". Set the Join Domain Method to "Use vSphere Authentication Proxy to add the host to domain". N/A N/A Site Specific Modify No http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-084B74BD-40A5-4A4B-A82C-0C9912D580DC.html</li>
</ul>