VCP6-DCV Section 1: Configure and Administer vSphere 6.x Security

Section 1 of the VCP6-DCV blueprint

Objective 1.1: Configure and Administer Role-based Access Control

1. Compare and contrast propagated and explicit permission assignments
• Propagated: A permission that is inherited by the child object from the parent object, IE; a VM inherits permissions from both the parent host and the vCenter above the host by default, but can be removed by clearing the Propagate to Children checkbox.
• Explicit: A permission that is set specifically on the object. IE; a user is assigned the permission to only see and not modify a particular VM.  
2. View/Sort/Export user and group lists
• At the bottom right hand side of a hosts users list window there is a drop down to View/Sort/Export, into a HTML, XML, Excel or CSV format.
3. Add/Modify/Remove permissions for users and groups on vCenter Server inventory objects
• Add :
• Navigate to the object you want to add permissions to. 
• On the Mange tab click on the sub-tab Permissions
• Click on the Add button and then identify the user or group and which role they will be fulfilling
• Pick the domain dropdown menu, Select the domain the user is a part of, Click Add
• Assign a role from the Assigned role drop-down menu.
• You can limit propagation by unchecking the 'Propagate to Child Objects Check box' 
• Modify :
• Follow same steps as before, Select Object -> Manage -> Permissions
• Select the user or group and click on the change icon
• From the assigned role drop down, change to new role, 
• You can limit propagation by unchecking the 'Propagate to Child Objects Check box' 
• Remove :
• Follow same steps as before, Select Object -> Manage -> Permissions
• Select the user or group and click on the Remove icon.
4. Determine how permissions are applied and inherited in vCenter Server
• Permissions are inherited in a hierarchical format, top down, EX; vCenter permissions are applied to Hosts, which are then Applied to Folders and VMs. Thus if you create a permission in vCenter, it will propagate to all other objects. If you add a permission at the Host level, that will only affect that one host. Explicit Permissions will always override an inherited permission, IE; if you set a permission to deny a particular function on one folder of VMs but not another, that permission take precedent on that folder. 
5. Create/Clone/Edit vCenter Server Roles
• Create :
• Click on Home -> Administration -> Roles
• Click on the Add button, 
• Give the role a name and select the privileges that role will have.
• Clone :
•  Click on Home -> Administration -> Roles
• Click on the Role you want to clone and click on the "Clone Role Action" button
• Give the new Role a name and edit any roles if needed.
• Edit : 
• Click on Home -> Administration -> Roles
• Click on the role you want to change and click on the edit button,
• Edit any role selections you may need.
6. Configure VMware Directory Service
• Click on Home -> Administration -> Configuration
• Click on 'Identity Sources' and click the Add button
• In the Window that is presented, select the Directory Service appropriate to your setup, and enter the information of an account that can join the the domain. and click OK. 
7. Apply a role to a User/Group and to an object or group of objects
• Click on Home -> Administration -> Global Permissions
• Click on the Manage tab, then either add a role or edit an existing one, 
• Click Add for Users or Groups and add the desired User/Group
• Click on the dropdown for Assigned Role and select the Role you would like to assign to the user. 
• Leave Propagate to Children option.
8. Change permission validation settings
• Select the vCenter object in Hosts and Clusters, 
• Select Manage -> Settings -> General -> Edit
• Select User Directory  and change values as needed.
9. Determine the appropriate set of privileges for common tasks in vCenter Server
• Many tasks require several permissions on more than one object to operate. See the table below.
• 
10. Compare and contrast default system/sample roles
• System Roles:
• Cannot be modified or deleted
• Sample Roles:
• Preexisting example roles set in vCenter and ESXi systems, you can create new roles or use these sample rols as a starting point. 
11. Determine the correct permissions needed to integrate vCenter Server with other VMware products
• Global permissions are applied to a global root object that spans all solutions in the tree (IE; vCenter -> Hosts) Use Global Permissions to give a user or group privileges for all objects in a hierarchy.
• Each Host has its own root Object in its own hierarchy. The global root object (vCenter) acts as a parent object to each individual host. The Role determines the set of privileges. 

Objective 1.2: Secure ESXi, vCenter Server, and vSphere Virtual Machines

1. Harden virtual machine access
1. Control VMware Tools installation
• VM.Disable-VMtools-autoinstall
• Parameter:isolation.tools.autoinstall.disable
2. Control VM data access
• 
  
3. Configure virtual machine security policies
• Rule of thumb, treat securing a VM like a physical machine. 
• Keeping both OS and installed applications patched, Anti-Virus, disabled unecessary services amd proper access to the system.
• For VM specific settings see Section 7 of the vSphere Security documentation.
• VM Best Practices:
• Use templates to deploy virtual machines
• Minimize use of virtual machine console
• Prevent virtual machines from taking over resources
• Disable unnecessary functions inside virtual machines
• Remove unnecessary hardware devices
• Disable unused display features
• Disable unexposed features
• Disable HGFS file transfers
• Disable copy and paste operations between guest operating system and remote console
• Limiting exposure of sensitive data copied to the Clipboard
• Restrict users from running commands within a virtual machine
• Prevent a virtual machine user or process from disconnecting devices
• Modify guest operating system variable memory limit
• Prevent guest operating system process from sending configuration messages to the host
• Avoid using Independent Nonpersistent Disks
2. Harden a virtual machine against Denial-of-Service attacks
1. Control VM-VM communications
• 
  
2. Control VM device connections
• 
  
3. Configure network security policies
• Network Security Policies can be set on both vSphere Standard Switches (VSS) and vSphere Distributed Switches (VDS) at the switch or Port Group Level
• MAC Address Changes: 
• Accept - ESXi allows the changing of Effective MAC address 
• Reject - Does not allow for those changes to occur, This prevents MAC spoofing
• Forged Transmissions:
• Accept - ESXi does not compare the source and effective MAC addresses.
• Reject -  ESXi does check the source and effective MAC addresses of the client, if they do not match the ESXi host drops the packet.
• Promiscuous Mode: 
• Accept - The Guest OS can receive all network packets, helpful when doing troubleshooting with a tool such as WireShark.
• Reject - Guest OS are not allowed to receive all network traffic on the wire.
3. Harden ESXi Hosts
1. Enable/Configure/Disable Services in the ESXi Firewall
• From Home -> Hosts and Clusters -> Host -> Manage -> Settings
• Under System -> Security Profile
• A list of services are displayed, they can be set to the following states,
• Start and stop with Host
• Start and stop Manually
• Start and stop with Port Usage
2. Change default account access
• 
  
3. Add an ESXi Host to a directory service
1. From Home -> Hosts and Clusters -> Host -> Manage -> Settings
2. Under System -> Authentication Services, click on 'Join Domain'
• In the Domain Settings windows enter the FQDN of the Domain Controller and User Credentials to join it to the domain.
4. Apply permissions to ESXi Hosts using Host Profiles
1. From Home -> Host Profiles
• Select the profile you'd like to add too (Or create a new one)
• Click on Manage -> Settings -> Edit Host Profile
• Expand Security and Services
• Select the Permissions Rule folder you want to add too and click the Add button
• In the right hand menu select the Permission to set and click next finish.
5. Enable Lockdown Mode
• From Home -> Hosts and Clusters -> Host -> Manage -> Settings
• Under System -> Security Profile
• In the right hand panel select edit to the right hand side of Lockdown Mode
• Lockdown mode supports three configurations:
• Normal - The host is accessible through local console and vCenter server
• Strict - The host is accessible only through vCenter server. The Direct Console UI service is stopped.
• There is an option to add users to the Exception Users list, these users do not lose their permissions to privileges when a host is placed in Lockdown mode. 
6. Control access to hosts (DCUI/Shell/SSH/MOB)
• From the Direct Console User Interface press F2 and log in
• Select, Configure Lockdown Mode and press Enter
• Use the Space bar to Enable/Disable
• Press Esc or Enter to accept the changes.
4. Harden vCenter Server
1. Control datastore browser access
• You can use teh Datastore.Low level file operations privilage to restrict access to the datastore browser.
• Allows performing read, write, delete, and rename operations in the datastore browser.
2. Create/Manage vCenter Server Security Certificates
• Handled with the VMware Certificate Authority (VMCA), using the VMCS cli to replace the default certificates
• Can manage certificates in three ways
• VMCA Default - Provides certificates to vCenter and ESXi hosts with VMCA being listed as the root certificate authority. Expires after 10 years be default
• Make VMCA an Intermediate CA - Replace the VMCA root certificate with a certificate signed by your enterprise certificate authority or a third party certificate authority
• Do not use VMCA - If you want ot manually issue and manage all the needed certificates for vSphere components that is an option. 
• To Manage Certificates (View and replace)
• vSphere Certificate Manager Utility - Perform all common certificate replacement tasks from the command line. 
• Certificate Manager CLI - Perform all certificate management tasks with dir-cli, certool, and vecs-cli
• vSphere Web Client - View certificates, including expiry informaiton (Note: not able to create here)
• Further details in Section 3: of VSphere Security Certificates of the vSphere Security 6.0 documentation.
3. Control MOB access
• Use the Managed Object Browser only for debugging, and ensure that is disabled in production
• Select the Host and go to Advanced System Settings
• Check the value of Config.HostAgent.plugins.solo.enableMob and change as appropriate.
4. Change default account access
• Because many appliances do not include default user accounts, the root account may still be able to directly login via SSH. To meet the compliance standards for non- repudiation, the SSH server on all hardened appliances comes preconfigured with the AllowGroups wheel entry to restrict ssh access to the secondary group wheel.
5. Restrict administrative privileges
• Many tasks can be performed by the root user by default. Instead of allowing administrators to log in to the ESXi host using the root user account, you can apply different host configuration privileges to different named users from the vCenter Server permissions management interface. You can create a custom roles, assign privileges to the role, and associate the role with a named user and an ESXi host object from the vSphere Web Client.
5. Understand the implications of securing a vSphere environment
• The primary measures required for hardening an ESXi host involve securing and properly managing the interfaces with the system that are used for configuration, management, and troubleshooting.

Objective 1.3: Enable SSO and Active Directory Integration

1. Describe SSO architecture and components
• vCenter Single Sign-On allows vSphere components to communicate with each other through a secure token mechanism instead of requiring users to authenticate separately with each component.
2. Differentiate available authentication methods with VMware vCenter
• vCenter Single Sign-On uses a combination of STS (Security Token Service), SSL for secure traffic, and authentication of human users through Active Directory or OpenLDAP and of solution users through certificates.
3. Perform a multi-site SSO installation
• In this configuration each site is independent with PSC replication between sites. The vCenter Server is aware of the site topologies and use the local PSC under normal circumstances. Customers are able to seamlessly move the vCenter Servers between PSCs when necessary. This topology allows for Enhanced Linked Mode (ELM) which is facilitated by the PSC. Enhanced Linked Mode provides for a single point of management for all vCenter Servers in the same vSphere domain. In vSphere 6 the Windows-based and Virtual Appliance-based vCenter Servers have the same operational maximums and can belong to the same linked mode configuration. The configuration replicates all license, global permissions, tags and roles across all sites
4. Configure/Manage Active Directory Authentication
• Active Directory authentication is configured from the Single Sign-On administration page, here you will add an additional identify source for Active Directory.
• If using Microsoft Active Directory, select Active Directory (Integrated Windows Authentication). It will auto-populate the root domain in the forest. If using Open LDAP, select and configure it.
5. Configure/Manage Platform Services Controller (PSC)
• The PSC includes common services used across VMware vCloud Suite. This includes VMware vCenter Single Sign-On, licensing, and certificate management.
• This is managed and configured by using the vSphere Web Client and selecting Administration and then System configuration and choosing the appropriate node.
6. Configure/Manage VMware Certificate Authority (VMCA)
• VMCA is included in each Platform Services Controller and in each embedded deployment. VMCA provisions each node, each vCenter Server solution user, and each ESXi host with a certificate that is signed by VMCA as the certificate authority. vCenter Server solution users are groups of vCenter Server services. See vSphere Security for a list of solution users. You can replace the default certificates. For vCenter Server components, you can use a set of command-line tools included in your installation. You have several options.
• You can either use the VMCA as a certificate authority or configure it to be an intermediate CA.
7. Enable/Disable Single Sign-On (SSO) Users
• You configure vCenter Single Sign-On from the vSphere Web Client. To configure vCenter Single Sign-On, you must have vCenter Single Sign-On administrator privileges. Having vCenter Single Sign-On administrator privileges is different from having the Administrator role on vCenter Server or ESXi. By default, only the user administrator-vsphere.local has administrator privileges on the vCenter Single SignOn server in a new installation Identify available authentication methods with VMware vCenter
8. Upgrade a single/multi-site SSO installation
• 
  
9. Configure SSO policies
• Password Policy: You can configure the following parameters:
• Description – Password policy description. Required.
• Maximum lifetime – Maximum number of days that a password can exist before it has to be changed.
• Restrict re-use – Number of the user’s previous passwords that cannot be set again.
• Maximum length – Maximum number of characters that are allowed in the password.
• Minimum length – Minimum number of characters required in the password.
• Character requirements – Minimum number of different character types required in the password.
• Identical adjacent characters – Maximum number of identical adjacent characters allowed in the password.
• Lockout Policy: Specifies the condition under which a vCenter SSO account is locked when the user attempts to log in with incorrect credentials. Five login attempts and three minutes between failures are set by default. This policy also specifies the time that must elapse before the account is automatically unlocked.
• Description – Description of the lockout policy. Required.
• Max. number of failed login attempts – Maximum number of failed login attempts that are allowed before the account is locked.
• Time interval between failures (seconds) – Time period in which failed login attempts must occur to trigger a lockout.
• Unlock time (seconds) – Amount of time that the account remains locked. If you enter 0, the account must be explicitly unlocked by an administrator.
• Token Policy
• Maximum token renewal count
• Maximum token delegation count
• Maximum bearer token lifetime
• Maximum holder-of-key token lifetime
10. Add/Edit/Remove SSO identity sources
• Open your Web browser and navigate to https://vcenter:9443, where vcenter is the FQDN of the vCenter Server.
• Log in with User name administrator@vsphere.local and the Password used during installation.
• Click Administration in the left-hand Navigator pane
• Click Configuration under vCenter Single Sign-On
• Click Identity Sources
• Click the green plus icon to Add Identity Source.
• If using Microsoft Active Directory, select Active Directory (Integrated Windows Authentication). It will autopopulate the root domain in the forest. If using Open LDAP, select and configure it.
• Highlight the newly added identity source. Click the Set as Default Domain icon.
• Click Yes in the pop-up.
11. Add an ESXi Host to an AD domain
• Select a host in the vSphere Client inventory, and click the Configuration tab.
• Under Software, click Authentication Services.
• Click Properties.
• In the User Directory Services dialog box, select the directory service from the drop-down menu.
• Enter a domain.
• Click Join Domain.
• Enter the user name and password of a directory service user who has permissions to join the host to the domain, and click OK.
• Click OK to close the Directory Services Configuration dialog box.