VMware has released the vSphere 4.0 Hardening Guide

VMware would like to announce the availability of the final release of the vSphere 4.0 Security Hardening Guide. This version incorporates the extensive feedback from the VMware community on the previous draft release, which was published in January. We would like to thank all the people who took the time to go through the draft release and provide their comments.

vSphere Hardening Guide provides guidance on how to securely deploy vSphere 4.0 in a production environment. The focus is on initial configuration of the virtualization infrastructure layer, which covers the following:

•The virtualization hosts (both ESX and ESXi)
•Configuration of the virtual machine container (NOT hardening of the guest OS or any applications running within)
•Configuration of the virtual networking infrastructure, including the management and storage networks as well as the virtual switch (but NOT security of the virtual machine’s network)
•vCenter Server, its database, and client components
•VMware Update Manager (included because the regular update and patching of the ESX/ESXi hosts and the virtual machine containers is essential to maintaining the security of the environment)

http://communities.vmware.com/docs/DOC-12306

VMware Update manager does not scan hosts??? Disable Internet Explorer Enhanced Security Configuration on Win2k8

VMware update manager hated me and wouldn’t scan any of my hosts, one of the many fixes I was trying was making sure that my VMware Update Manager server could reach the patch stores to download updates and do patch checks and so decided to make sure of this I wanted to remove the painfully irritating Internet Explorer Enhanced Security Configuration. Now before I get loads of comments saying this is dangerous etc etc and that it’s a security risk,I know it is but for testing purposes I wanted to do it so I did. Now the point of this blog is that to disable it isn’t as easy as it used to be in 2003 as you used to just:

• Go to Control Panel
• Add/Remove Programs, 
• Add/Remove Windows Components on the left hand side

• Untick it from the drop down list

But for Windows Server 2008 I couldn’t find it anywhere in the features drop down lists which has replaced the Windows Components in Server 2008. Fortunately while on another Server 2008 server I noticed the place to disable it. In the Server Manager root page under the Security Information section is Configure IE ESC

 All you need to do is click on this link and disable it for either Administrators and/or for Users. I only needed for Administrators so this is what I selected for the testing.

Source : EMC Feeds

VMware announced vSphere 4.0 Hardening Guide Public Draft Release

Source  : VMware Security Blog
VMware would like to announce the availability of a public draft for the vSphere 4.0 Security Hardening Guide.  This guide represents a new approach to providing security guidance from VMware. As compared with the previous VI3 Hardening Guides, the current guide has the following highlights

• Structure: this version uses a standardized format, with formally defined sections, templates, and reference codes.  The goal is to increase clarity and reduce ambiguity, make it easier to reference individual guidelines, and most of all, enhance the ability to automate guideline enforcement.
• Recommendation levels: in following with the formats used by NIST, CIS, and others, this guide categorizes all guidelines into three security levels.  Instead of recommending a single set of guidelines for all environments, this guide encourages more of a risk-based approach, so that individual administrators can decide which guidelines apply to their environment.

Overall, there are more than 100 guidelines. The guide itself is split into the following major sections: (PDF below)

• vSphere 4.0 Security Hardening Guide: Introduction (REV B)
  
• vSphere 4.0 Security Hardening Guide: Virtual Machines (REV B)
  
• vSphere 4.0 Security Hardening Guide: Hosts (REV B)
  
• vSphere 4.0 Security Hardening Guide: vNetwork (REV B)
  
• vSphere 4.0 Security Hardening Guide: vCenter (REV B)
  
• vSphere 4.0 Security Hardening Guide: COS (REV B)