VMware VCM 5.3 - CONFIGURATION MANAGER SECURITY ENVIRONMENT... Quick guide

vCenter Configuration Manager

Security Environment Requirements

VMware VCM 5.3

WHITE PAPER

TECHNICAL WHITE PAPER / 2

Table of Contents

1.0 Introduction to The Security Environment of VCM 5

2.0 Background Concepts 6

3.0 Secure Domain Infrastructure 9

3.1 Domain controller is trusted 9

3.2 Network infrastructure is secure 9

3.3 Network infrastructure services are available 9

3.4 'Trusted' certificates, certificate authorities, and certificate servers are trusted 9

3.5 Network infrastructure hosts are at least as secure as VCM 10

4.0 Hosting Environment 11

4.1 VCM servers are secured and managed like network infrastructure 11

4.2 UI Zone machines should be subject toaccess controls 11

4.3 Data originating from a managed machine is no more trustworthy than the machine 12

4.4 Server zone machine dedicated to VCM 12

5.0 Personnel Selection and Training 13

5.1 VCM accounts are granted to users who are trusted, trained, and qualified as system and net-

work administrators 13

5.2 VCM users are advised to treat direct login prompts to VCM with skepticism and caution 13

5.3 VCMusers must protect collected data as confidential information 13

5.4 Trust individual collectionresults nomore than their source 13

5.5 Beware of cross-site scripting attacks 14

5.6 Exported data is outside the control of VCM 14

6.0 Host Preparation and Management 15

6.1 VCM hosts pass Foundation Checker checks 15

6.2 Cryptographic service providers are FIPS-140 certified 15

6.3 SQL Server best practices are followed 16

6.4 Only trusted software should be installed in the server zone 16

6.5 Perform routine backups, patches, and virus scanning 16

7.0 Safeguarding Installation Kits 17

vCenter Configuration Manager Security Environment Requirements

TECHNICAL WHITE PAPER / 3

7.1 VCM installation kits are obtained from VMware or secure sources 17

7.2 VCM installation kits are protected from tampering or verified 17

7.3 Unknown software publisher warnings during ClickOnce installations are not dismissed unless

the publisher is VMware 18

7.4 Automatic upgrade of the VCM Remote Client is not used to install software 18

8.0 IIS Preparation 19

8.1 IIS set to use Windows integrated authentication for the VCM Web site root 19

8.2 VCM Web Service uses HTTPS 19

8.3 SSL/HTTPS certificate issued by trusted CA or self Issued 19

9.0 SQL Server Preparation 20

9.1 Follow Microsoft SQL Server configuration best practices 20

9.2 Use delegation with a VCM split installation 20

9.3 Protect SQL Server from connections originating outside the server zone 20

9.4 Forbid direct SQL Server login by VCM users 20

10.0 Web Browser Preparation 21

10.1 Place the VCM Web host in the IE trusted zone 21

10.2 Verify the VCM Web host's HTTPS certificate 21

10.3 Verify the VCM software publisher certificate 21

10.4 Remove untrusted machines from the IE trusted zone 21

10.5 Customize Internet Explorer's trusted zone Internet security options 22

11.0 Agent Installation and Maintenance 23

11.1 File and directory access controls prevent tampering 23

11.2 Access control on machine configuration prevents tampering 23

11.3 The Agent is available for collection 23

11.4 The Trusted Certificate Store contains reputable certificates 24

11.5 The enterprise certificate authorized collection 24

11.6 Unauthorized (private) Agents are not allowed 24

11.7 Continuous possession and control of the Agent 24

12.0 Software Provisioning Components 25

12.1 All published packages are signed by trusted parties 26

12.2 Protect repositories 26

vCenter Configuration Manager Security Environment Requirements

TECHNICAL WHITE PAPER / 4

12.3 Accept only reputable software package publishers 26

12.4 Configure only trusted sources over secure channels 26

12.5 Take precautions when using VCM Software Provisioning Extensions 26

13.0 Proper Decommissioning 28

13.1 An installation of VCM is properly decommissioned before its hardware is repurposed or

retired 28

13.2 Collector and Agent private keys used for TLS are not copied between machines 28

13.3 Enterprise certificate private key and IIS (for HTTPS) host private keys are transferred manually 29

13.4 Server zone hosts have their disks removed and transferred, secured, or erased before decom-

missioning 29

13.5 Agent private keys are erased at Agent install 29

13.6 Unused network authority accounts are disabled or removed 29

References 30

vCenter Configuration Manager Security Environment Requirements

TECHNICAL WHITE PAPER / 5

1.0 Introduction to The Security Environment of VCM

VCM operates within the context of a security environment. This environment consists of host configuration, various

personnel and usage assumptions, organizational security policies, configuration settings, and best practices.

Ultimately all security requirements are met either by controls built into VCM that leverage the environment, or by

controls built into the environment itself. Understanding and maintaining the security environment is an important

responsibility of the VCM administrator and users. Toward that end, this document provides a description of the VCM

security environment and a checklist for its maintenance.

The security environment must provide certain guarantees. For example, authorized VCM users are presumed to be

trusted, and the hosts on which VCM is installed must be access-controlled to prevent access by unauthorized users.

Installation kits must be checked for alteration, and eventually VCM hosts must be decommissioned properly. Overall

security requirements must be observed for the domain and infrastructure, hosting environment, personnel, host

preparation, installation kit security, login roles, IIS preparation, SQL server preparation, web browsers preparation,

Agent installation and maintenance, and proper decommissioning.

When a security environment requirement is not met, the confidentiality, integrity, or availability of information assets

that flow through the deficient system are at risk.

This is not a prescriptive document. Described within are the assumptions made by VCM, not procedures for

administrators. For example, under the guarantees regarding VCM logins, an assumption made by VCM is that the

domain controller for each user is trusted. Not listed is a best practice such as "keep the domain controller in a locked

room."

vCenter Configuration Manager Security Environment Requirements

TECHNICAL WHITE PAPER / 6

2.0 Background Concepts

Numerous physical and conceptual objects make up a VCM installation. These are described in detail in the VCM

Hardware and Software Requirements Guide as well as in the VCM Installation and Getting Started Guide. For

convenience, a summary of that information is repeated here.

VCM is a distributed application with five main components:

lBrowser-based user interface (UI) that renders in Internet Explorer (IE) on user desktops

lInternet Information Services (IIS) web server that hosts the UI web application and accepts work requests

lCollector service that processes requests and receives results

lSQL Server database that stores both results and application control information

lAgents that inspect managed machines and return results in response to requests.

In some installations there are also optional ancillary components such as an Agent proxy that works with VMware

ESX, ESXi, and vSphere servers, an orchestration host that coordinates with service desk applications such as

Remedy, VCM Remote service, Software Provisioning components, and alternate source file servers that store VCM

installation kits and VCM Patching patches.

With the exception of the UI, Agent, and alternate sources, all VCM components execute on Microsoft Windows

Server computers. The UI runs within IE on Windows desktops. The Agent executes on either Windows or one of a

variety of UNIX systems (Solaris, HPUX, AIX, Linux, or Max OS X). An alternate source can be any file server

exporting shares or ftp.

These components, with the exception of the UI Software Provisioning Repositories, and alternate source hosts, are

shown below.

These components, with the exception of the VCM Software Provisioning components, the UI, and alternate source

hosts, are shown below. Software Provisioning components are diagrammed separately in All published packages are

signed by trusted parties on page 26.

vCenter Configuration Manager Security Environment Requirements

TECHNICAL WHITE PAPER / 7

Figure 1: VCMSingle Server Installation

As shown in the figure, several VCM services can share a host. In a single-host installation, IIS, the web application,

SQL Server, and the Collector service are installed on a server machine referred to as the “Collector host”. There is an

optional split installation configurations where the SQL Server is installed on a database host separate from the

Collector host. However, VMware strongly recommends that you select the default, single machine installation type

because it will be the simplest to administer in the future. A split installation across two machines should be used only

when required by your organization’s policy.

Several different types of personnel utilize the five components of VCM. Domain administrators create the accounts

and manage the infrastructure in which VCM runs. The infrastructure includes domain controllers, routers, certificate

servers, SMTP email, domain name service (DNS) and DHCP. A VCM installer loads the VCM software and

configures IIS, SQL server, the Collector, and other services. The installer is also the first VCM administrator and is

responsible for authorizing the other administrators and regular VCM users from the inventory of accounts managed by

the domain administrators. VCM users and administrators log on to VCM and use its web interface to administer

managed machines via the Agents, run Compliance tests, and generate reports. Agents can be installed, upgraded,

and un-installed by either VCM administrators, users or managed machine administrators.

Conceptually, the VCM services, hosts, and personnel can be organized into the following trust zones:

TECHNICAL WHITE PAPER / 8

lInfrastructure: Consists of domain controllers (DCs), routers, SMTP, DNS, and other infrastructural items.

lUser Interface (UI): Consists of VCM user desktops.

lServer: Consists of the Collector service, VCM Remote service, IIS, web application, SQL Server, Orches-

trator, and Agent proxy.

lAgent: Each managed machine, software provisioning repository, and alternate source resides in an Agent

zone. There may be multiple Agent zones.

Domain administrators manage the infrastructure, UI and server zones. Each Agent zone is controlled by a local zone

administrator. This is often the managed machine or repository administrator

This partitioning allows us to understand trust between VCM components on a more granular level than DC domains.

A trust boundary separates each zone. Machines and services in one zone distrust those in another without either

special configuration or authentication. Special configuration establishes implicit trust. Authentication engenders trust

between components lacking implicit trust. When an entire zone trusts another, this means that every VCM

component in the first zone implicitly trusts every component in the second. If two machines are in the same zone, it

does not mean that they trust each other, rather it means that they are not required to distrust each other by default.

Once VCM is installed, the UI and Agent zones trust the infrastructure and server zone. On the other hand, the server

zone completely trusts only the infrastructure; it does not trust the UI zone except as a source of UI commands from

VCM users that were authenticated by the infrastructure. The server zone also trusts the Agent zone as a source for

Agent data but not to provide data or implement change that would affect other Agents or VCM configuration.

These trust zones and boundaries are pedagogical tools, and are not visible in the features of the VCM product. The

trust zones have no relationship to the zones in IE.

vCenter Configuration Manager Security Environment Requirements

TECHNICAL WHITE PAPER / 9

3.0 Secure Domain Infrastructure

VCM security environment requirements are divided into categories for the domain and infrastructure, hosting

environment, personnel, host preparation, safeguarding installation kits, login roles, IIS preparation, SQL Server

preparation, web browser preparation, Agent installation and maintenance, Software Provisioning, and proper

decommissioning.

This section describes the domain and infrastructure. Here and in subsequent sections, each requirement is

numbered, stated, and followed by elaborative text.

3.1 Domain controller is trusted

VCM relies on a domain controller (DC) to authenticate VCM users, to discover machines, to enumerate domain group

members, to run VCM services under Network Authority accounts, and to authenticate administrators who control the

hosts onto which VCM and its databases are installed. The VCM installer and VCM administrator cite the domain

controller in VCM when the system is installed, DC discoveries are conducted, or when new Network Authorities or

VCM users are added. An untrustworthy domain controller should never be configured into VCM and VCM hosts

should never be joined to an untrustworthy domain.

3.2 Network infrastructure is secure

Besides domain controllers, VCM relies on other network infrastructure services such a DNS, WINS, email, time

servers, and DHCP. The DNS and WINS translate domain names into IP addresses. Email is used for various

notifications and alerts. Time servers synchronize time, allowing Kerberos authentication and certificate validation to

work. DHCP, even when not used by VCM servers, assigns IP addresses consistently. These services must be

properly configured, secure, and available in order for VCM to operate correctly and reliably.

3.3 Network infrastructure services are available

All network infrastructure services must not only be correct and secure, but also available and responsive. An active

denial of service or attack on network infrastructure will impact VCM performance.

3.4 'Trusted' certificates, certificate authorities, and certificate servers are trusted

VCM establishes the validity of HTTPS/SSL certificates used by IIS, and of TLS certificates used during Collector-to-

Agent communication by checking the signatures along the certificate chain that extends from the certificate in

question up to a certificate installed in one of the trusted certificate stores.

VCM trusts that:

vCenter Configuration Manager Security Environment Requirements

TECHNICAL WHITE PAPER / 10

lA certificate in a 'trusted' store is in fact trusted

lCertificate authorities issuing certificates in a trusted store are trusted

lCertificate services managing certificates in a trusted certificate store and the associated renewals and cer-

tificate revocation lists are trusted

In particular, certificates that exist in the trusted store that were not issued in conjunction with VCM are still trusted by

VCM.

To view the contents of the trusted certificate stored on Microsoft platforms1, use the Certificate Manager Tool

(Certmgr.exe) or the Microsoft Management Console (MMC) Certificates snap-in.

3.5 Network infrastructure hosts are at least as secure as VCM

Since VCM relies on infrastructure services, machines on which these services are hosted must be at least as secure

as VCM. These machines should be protected by firewalls, anti-virus software, current security updates, and access

controls. Access to these machines should also be restricted to trusted personnel.

This manual suits for next models

Table of contents

Other VMware Software manuals

VMware

VMware VCM 5.3 User manual

VMware

VMware APPSPEED SERVER 1.5 - VCENTER APPSPEED INSTALLATION... Installation and operation manual

VMware

VMware VS4-STD-C - vSphere Standard - PC Instruction sheet

VMware

VMware THINAPP User manual

VMware

VMware VSHIELD EDGE User manual

VMware

VMware VSHIELD APP 1.0 - API Operating instructions

VMware

VMware DISK MOUNT UTILITY WORKSTATION 5.5 User manual

VMware

VMware ESX 4.0 - GETTING STARTED UPDATE 1 General instructions

VMware

VMware ESX 4.0 - GETTING STARTED UPDATE 1 User manual

VMware

VMware VIEW 4.5 User manual

VMware

VMware VIEW MANAGER 4.X - EXTENDING VIRTUAL MACHINE DELECTION WITH... User manual

VMware

VMware VIRTUALIZATION AND CLOUD MANAGEMENT Installation guide

VMware

VMware VLM3-ENG-CP - Lab Manager - PC User manual

VMware

VMware CLOUD DIRECTOR 1.0 User manual

VMware

VMware VCM 5.3 - TRANSPORT LAYER SECURITY... User manual

VMware

VMware VSHIELD APP 1.0.0 UPDATE 1 - API Operating instructions

VMware

VMware VCLOUD DIRECTOR User manual

VMware

VMware VCM 5.3 - RECOVERY GUIDE User manual

VMware

VMware VCENTER APPLICATION DISCOVERY MANAGER 6.0 User manual

VMware

VMware VIEW 4.5 - ARCHITECTURE PLANNING... User manual

VMware

VMware vSphere 4 Installation and operation manual

VMware

VMware 4817V62 - vSphere - PC Instruction Manual

VMware

VMware VCENTER CONFIGURATION MANAGER Quick guide

VMware

VMware ACE EN-000042-00 Use and care manual

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Novell

Novell GROUPWISE 8 - INTERNET AGENT manual

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual