Welcome to our last discussion on the <a href="http://communities.vmware.com/docs/DOC-19605">VMware vSphere 5.0 Hardening Guide</a> of the week. Here are links to the past articles from the week: <a href="http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1">one</a>, <a href="http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-2">two</a>, <a href="http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-3">three</a>, and <a href="http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-4">four</a>.
<ul>
	<li>Guideline Title: Verify contents of exposed configuration files
<ul>
	<li>Title: verify-config-files</li>
	<li>Discussion: Certain configuration files exist on ESXi hosts that govern host behavior and operations. These files should be logged and monitored for both authorized and unauthorized configuration changes. These files can be retrieved over HTTPS via http://&lt;hostname&gt;/host if the Managed Object Browser (MOB) is enabled. However, a separate VMware hardening recommendation we've previously covered advises that the MOB be disabled. If your organization chooses not to accept the risk of leaving the MOB enabled, these configuration files can also be retrieved via vCLI or PowerCLI.</li>
	<li><a href="http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_hosts.4.4.html">Official VMware documentation</a></li>
</ul>
</li>
	<li>Guideline Title: Keep ESXi system properly patched
<ul>
	<li>Title: apply-patches</li>
	<li>Discussion: ESXi is designed from the ground up to be a powerful but secure hypervisor with minimal attack surface area. A complete install disc is less than 300MB. ESXi needs patches much less frequently than ESX used to, but it does still need them. VMware Update Manager is a free tool included with vCenter to help automate the patching of ESXi hosts during production hours with no VM downtime. To stay on top of the latest VMware Security Advisories by email you can subscribe here - http://www.vmware.com/security/advisories/</li>
	<li><a href="http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.update_manager.doc_50/GUID-EF6BEE4C-4583-4A8C-81B9-5B074CA2E272.html">Official VMware documentation</a></li>
</ul>
</li>
</ul>
Note: I'm collapsing the next three hardening guide checks into a single entry since they are almost identical. I will point out in the discussion section where they differ.
<ul>
	<li>Guideline Title: Verify Image Profile and VIB Acceptance Levels
<ul>
	<li>Title(s): (1) verify-acceptance-level-certified, (2) verify-acceptance-level-accepted, (3) verify-acceptance-level-supported</li>
	<li>Discussion: vSphere Installation Bundles (VIBs) are files that can be used to extend ESXi functionality. They might perform functions such as enabling hardware status monitoring, adding new hardware drivers, or enabling third-party security virtual appliances. These VIBs can have one of four available acceptance levels: VMwareCertified, VMwareAccepted, PartnerSupported, and CommunitySupported. As their names imply, these four levels relate to the entity that tested and possibly certified the VIBs for use. When you configure the VIB Acceptance Level, you are instructing your ESXi hosts to only install VIBs that meet or exceed the specified level of support and testing.
<ul>
	<li>-VMwareCertified - these VIBs are created, tested, and signed by VMware. This is the recommended setting for environments hosting extremely sensitive data, including military environments authorized to handle classified data.</li>
	<li>-VMwareAccepted - These VIBs are created by a VMware Partner but are tested and signed by VMware. This is the recommended setting for environments hosting sensitive data or those subject to stricter compliance requirements.</li>
	<li>-PartnerSupported - These VIBs are created, tested, and signed by a certified VMware Partner. This is the recommended setting for all vSphere environments.</li>
	<li>-CommunitySupported - These VIBs are neither supported nor digitally signed. CommunitySupported VIBs should not be installed on production vSphere environments.</li>
</ul>
</li>
	<li>Official VMware documentation http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.install.doc_50/GUID-56600593-EC2E-4125-B1A0-065BDD16CF2D.html</li>
</ul>
</li>
</ul>