Welcome back to part 2 of our discussion of the vSphere 5.0 Hardening Guide! If you missed part 1, you can find it <a href="http://egroup.jasonmangone.com/vsphere-5-0-hardening-guide-discussion-part-1">here</a>. Let's get back to it!
<ul>
	<li>Guideline Title: Communication Configure the ESXi host firewall to restrict access to services running on the host
<ul>
	<li>Title: config-firewall-access</li>
	<li>Discussion: The process of hardening a production server involves stopping unnecessary services and protecting services that need to remain running, and ESXi is no different. Unnecessary services should be disabled. Necessary services can be protected by defining allowed IPs that are allowed to connect. These IPs can be set under "Configuration -&gt; Security Profile -&gt; Firewall -&gt; Properties". Select a service then click "Firewall", choose "Only allow connections from the following networks" and specify the IPs or ranges that will be allowed to connect.
<a href="http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png"><img class="alignnone  wp-image-6923" src="http://egroup.jasonmangone.com/wp-content/uploads/2012/06/esxi5firewall1.png" alt="" width="374" height="236" /></a></li>
	<li><a href="http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-DD4322FF-3DC4-4716-8819-6688938F99D7.html">Official VMware documentation</a></li>
</ul>
</li>
	<li>Guideline Title: Configure NTP time synchronization
<ul>
	<li>Title: config-ntp</li>
	<li>Discussion: NTP serves two purposes. First,  in the event of a security breach, having your ESXi system logs synchronized will lend itself to an effective incident postmortem, which can, in turn, help increase the security of your environment and further remediate vulnerabilities. Second,  NTP will be used by any VMs that utilize the VMware Tools time synchronization. When the host has accurate time, the VMs using it as a time source will also. I prefer to pick a single device inside the firewall (possibly the firewall itself) to serve as my internal NTP source. Then I have all my other hosts sync against that device. This means that if the internet connection goes down, only one system notices and the rest of the systems all stay in sync with each other, though not necessarily with the rest of the world. So set an NTP server choose "Configuration -&gt; Time Configuration -&gt; Options -&gt; start the NTP service and select "Start and stop with host"". Click 'Add' and specify your site's NTP servers.</li>
	<li><a href="http://pubs.vmware.com/vsphere-50/topic/com.vmware.vcli.examples.doc_50/cli_manage_networks.11.8.html">Official VMware documentation</a></li>
</ul>
</li>
	<li>Guideline Title: Ensure proper SNMP configuration
<ul>
	<li>Title: config-snmp</li>
	<li>Discussion: SNMP is a protocol for monitoring network resources (hosts, servers, switches, etc). If your environment is not using SNMP, it should be disabled to avoid disclosing ESXi host status information to malicious observers. (Of course, if you're following along, you've already locked down which IPs and ranges can reach the SNMP agent!) The ESXi SNMP agent is disabled by default. To confirm this, run "vicfg-snmp &lt;conn_options&gt; --show", or to disable it in environments where it is not used, run "vicfg-snmp &lt;conn_options&gt; --disable". If SNMP is being used, make sure the parameters are properly configured using either vCLI or PowerCLI, or using an API client.</li>
	<li><a href="http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.monitoring.doc_50/GUID-8EF36D7D-59B6-4C74-B1AA-4A9D18AB6250.html">Official VMware documentation</a></li>
</ul>
</li>
	<li>Guideline Title: Disable Managed Object Browser (MOB)
<ul>
	<li>Title: disable-mob</li>
	<li>Discussion: I can't put it any better than the VMware-provided description for this vulnerability already has. I'll quote it below directly from the Hardening Guidelines.
<ul>
	<li>"The managed object browser (MOB) provides a way to explore the object model used by the VMkernel to manage the host; it enables configurations to be changed as well. This interface is meant to be used primarily for debugging the vSphere SDK but because there are no access controls it could also be used as a method obtain information about a host being targeted for unauthorized access. To determine if the MOB is enabled run the following command on the ESXi shell: "vim-cmd proxysvc/service_list". To disable the MOB run the following command: "vim-cmd proxysvc/remove_service "/mob" "httpsWithRedirect"". Note: You cannot disable MOB while in lockdown mode. The MOB will no longer be available for diagnostics. Some 3rd party tools use this interface to gather information. Testing should be done after disabling the MOB to verify 3rd party applications are still functioning as expected. To re-enable the MOB: ~ # vim-cmd proxysvc/add_np_service "/mob" httpsWithRedirect"</li>
</ul>
</li>
	<li><a href="http://kb.vmware.com/kb/1016039">Official VMware documentation</a></li>
</ul>
</li>
	<li>Guideline Title: When adding ESXi hosts to Active Directory use the vSphere Authentication Proxy to protect passwords
<ul>
	<li>Title: enable-auth-proxy</li>
	<li>Discussion: In environments that use both ESXi Autodeploy and Active Directory to manage hosts, the password used to join Active Directory is sent in cleartext to each host as it boots up, which puts that password at great risk of interception. Instead, VMware provides a vSphere Authentication Proxy to help keep this communication secure. Here are the <a href="http://pubs.vmware.com/vsphere-50/index.jsp?topic=%2Fcom.vmware.vsphere.install.doc_50%2FGUID-EA920335-2608-4127-9B57-DB3809BA4BB9.html">official deployment instructions</a>.</li>
	<li><a href="http://pubs.vmware.com/vsphere-50/topic/com.vmware.vsphere.security.doc_50/GUID-084B74BD-40A5-4A4B-A82C-0C9912D580DC.html">Official VMware documentation</a></li>
</ul>
</li>
</ul>
We'll pick this back up tomorrow and knock out another 5 ESXi hardening checks!