CIS VMware vCenter 8 Benchmark

This recommendation verifies that SSO Password Policy Enforces Complexity on the VMware vCenter 8 virtualization management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the VMware vCenter 8 virtualization management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# PowerCLI:
Connect-SsoAdminServer -Server <vcenter> -User administrator@vsphere.local
Get-SsoPasswordPolicy | Select MinLength, MaxLength, MinAlphabeticCount, MinUppercaseCount, MinLowercaseCount, MinNumericCount, MinSpecialCharCount

# PowerCLI — Set SSO password policy:
Get-SsoPasswordPolicy | Set-SsoPasswordPolicy -MinLength 15 -MaxLength 64 -MinUppercaseCount 1 -MinLowercaseCount 1 -MinNumericCount 1 -MinSpecialCharCount 1

This recommendation verifies that SSO Account Lockout Policy Is Configured on the VMware vCenter 8 virtualization management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the VMware vCenter 8 virtualization management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# PowerCLI:
Get-SsoLockoutPolicy | Select MaxFailedAttempts, AutoUnlockIntervalInSeconds, FailedAttemptIntervalInSeconds
# MaxFailedAttempts should be <= 5

# PowerCLI — Set SSO lockout policy:
Get-SsoLockoutPolicy | Set-SsoLockoutPolicy -MaxFailedAttempts 5 -AutoUnlockIntervalInSeconds 300 -FailedAttemptIntervalInSeconds 180

This recommendation verifies that SSO Password Expiry Is Configured on the VMware vCenter 8 virtualization management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the VMware vCenter 8 virtualization management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# PowerCLI:
Get-SsoPasswordPolicy | Select PasswordLifetimeDays, ProhibitedPreviousPasswordsCount
# PasswordLifetimeDays should be <= 90

# PowerCLI — Set password expiry:
Get-SsoPasswordPolicy | Set-SsoPasswordPolicy -PasswordLifetimeDays 90 -ProhibitedPreviousPasswordsCount 5

This recommendation verifies that External Identity Source Is Configured on the VMware vCenter 8 virtualization management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the VMware vCenter 8 virtualization management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# VAMI (https://<vcenter>:5480):
# Administration > Identity Sources
# Verify Active Directory or LDAPS is configured

# PowerCLI:
Get-IdentitySource | Select Name, Type, FriendlyName

# PowerCLI — Add AD identity source:
Add-LDAPIdentitySource -Name 'corp.local' -DomainName 'corp.local' -DomainAlias 'CORP' -PrimaryUrl 'ldaps://dc.corp.local:636' -BaseDNUsers 'dc=corp,dc=local' -BaseDNGroups 'dc=corp,dc=local' -ServerType ActiveDirectory -Certificates (Get-Content ad-cert.pem)

This recommendation verifies that Administrator Role Membership Is Reviewed on the VMware vCenter 8 virtualization management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the VMware vCenter 8 virtualization management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# PowerCLI:
Get-VIPermission | Where-Object {$_.Role -eq 'Admin'} | Select Principal, Entity, Propagate | Format-Table
# Review users with Administrator role — should be minimal

# PowerCLI — Remove unnecessary admin permissions:
Get-VIPermission | Where-Object {$_.Principal -eq 'DOMAIN\\user' -and $_.Role -eq 'Admin'} | Remove-VIPermission -Confirm:$false

# Create custom role with least privilege:
New-VIRole -Name 'CustomVMAdmin' -Privilege (Get-VIPrivilege -Id 'VirtualMachine.Interact.*')

This recommendation verifies that No Permissions Are Assigned to Everyone on the VMware vCenter 8 virtualization management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the VMware vCenter 8 virtualization management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# PowerCLI:
Get-VIPermission | Where-Object {$_.Principal -eq 'Everyone'} | Format-Table
# No permissions should be assigned to 'Everyone'

# PowerCLI — Remove 'Everyone' permissions:
Get-VIPermission | Where-Object {$_.Principal -eq 'Everyone'} | Remove-VIPermission -Confirm:$false

This recommendation verifies that Custom Roles Follow Least Privilege on the VMware vCenter 8 virtualization management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the VMware vCenter 8 virtualization management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# PowerCLI:
Get-VIRole | Where-Object {$_.IsSystem -eq $false} | Select Name, PrivilegeList | Format-Table
# Review custom roles for excessive privileges

# PowerCLI — Remove excessive privileges from a role:
Set-VIRole -Role 'CustomRole' -RemovePrivilege (Get-VIPrivilege -Id 'Host.Config.*')

This recommendation verifies that Promiscuous Mode Is Rejected on the VMware vCenter 8 virtualization management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the VMware vCenter 8 virtualization management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# PowerCLI:
Get-VMHost | Get-VirtualSwitch -Standard | Get-SecurityPolicy | Select VirtualSwitch, AllowPromiscuous, ForgedTransmits, MacChanges
# AllowPromiscuous should be false

# PowerCLI — Reject promiscuous mode:
Get-VMHost | Get-VirtualSwitch -Standard | Get-SecurityPolicy | Set-SecurityPolicy -AllowPromiscuous $false -ForgedTransmits $false -MacChanges $false

This recommendation verifies that VDS Security Policies Reject Promiscuous Mode on the VMware vCenter 8 virtualization management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the VMware vCenter 8 virtualization management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# PowerCLI:
Get-VDSwitch | Get-VDSecurityPolicy | Select VDSwitch, AllowPromiscuous, ForgedTransmits, MacChanges
# All should be false

# PowerCLI — Set VDS security policy:
Get-VDSwitch | Get-VDSecurityPolicy | Set-VDSecurityPolicy -AllowPromiscuous $false -ForgedTransmits $false -MacChanges $false

This recommendation verifies that VMs Are Not on Native VLAN on the VMware vCenter 8 virtualization management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the VMware vCenter 8 virtualization management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# PowerCLI:
Get-VMHost | Get-VirtualSwitch -Standard | Get-VirtualPortGroup | Select Name, VLanId
# Verify no VMs on VLAN 1 (default/native VLAN)

# PowerCLI — Change VLAN assignment from native VLAN:
Get-VirtualPortGroup -Name 'VM Network' | Set-VirtualPortGroup -VLanId 100

This recommendation verifies that Unnecessary Firewall Rules Are Disabled on the VMware vCenter 8 virtualization management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the VMware vCenter 8 virtualization management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# PowerCLI:
Get-VMHost | Get-VMHostFirewallException | Where-Object {$_.Enabled} | Select Name, ServiceRunning, IncomingPorts, OutgoingPorts | Format-Table
# Review enabled firewall rules

# PowerCLI — Disable unnecessary firewall rules:
Get-VMHost | Get-VMHostFirewallException -Name 'SSH Server' | Set-VMHostFirewallException -Enabled $false

This recommendation verifies that SSH Service Is Disabled on the VMware vCenter 8 virtualization management platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the VMware vCenter 8 virtualization management platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# PowerCLI:
Get-VMHost | Get-VMHostService | Where-Object {$_.Key -eq 'TSM-SSH'} | Select VMHost, Running, Policy
# SSH should not be running unless needed; Policy should be 'off'

# PowerCLI — Disable SSH on all hosts:
Get-VMHost | ForEach-Object {
  Stop-VMHostService -HostService ($_ | Get-VMHostService | Where-Object {$_.Key -eq 'TSM-SSH'}) -Confirm:$false
  Set-VMHostService -HostService ($_ | Get-VMHostService | Where-Object {$_.Key -eq 'TSM-SSH'}) -Policy 'off'
}

This recommendation verifies that Copy Operations Are Disabled on the VMware vCenter 8 virtualization management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the VMware vCenter 8 virtualization management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# PowerCLI:
Get-VM | Get-AdvancedSetting -Name 'isolation.tools.copy.disable' | Select Entity, Name, Value
# Value should be TRUE

# PowerCLI — Disable copy operations:
Get-VM | New-AdvancedSetting -Name 'isolation.tools.copy.disable' -Value 'TRUE' -Force -Confirm:$false

This recommendation verifies that Paste Operations Are Disabled on the VMware vCenter 8 virtualization management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the VMware vCenter 8 virtualization management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# PowerCLI:
Get-VM | Get-AdvancedSetting -Name 'isolation.tools.paste.disable' | Select Entity, Name, Value
# Value should be TRUE

# PowerCLI — Disable paste operations:
Get-VM | New-AdvancedSetting -Name 'isolation.tools.paste.disable' -Value 'TRUE' -Force -Confirm:$false

This recommendation verifies that Disk Shrinking Is Disabled on the VMware vCenter 8 virtualization management platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the VMware vCenter 8 virtualization management platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# PowerCLI:
Get-VM | Get-AdvancedSetting -Name 'isolation.tools.diskShrink.disable' | Select Entity, Name, Value
# Value should be TRUE

# PowerCLI — Disable disk shrink:
Get-VM | New-AdvancedSetting -Name 'isolation.tools.diskShrink.disable' -Value 'TRUE' -Force -Confirm:$false

This recommendation verifies that Disk Wiping Is Disabled on the VMware vCenter 8 virtualization management platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the VMware vCenter 8 virtualization management platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# PowerCLI:
Get-VM | Get-AdvancedSetting -Name 'isolation.tools.diskWiper.disable' | Select Entity, Name, Value
# Value should be TRUE

# PowerCLI — Disable disk wiper:
Get-VM | New-AdvancedSetting -Name 'isolation.tools.diskWiper.disable' -Value 'TRUE' -Force -Confirm:$false

This recommendation verifies that Console Connection Limit Is Set on the VMware vCenter 8 virtualization management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the VMware vCenter 8 virtualization management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# PowerCLI:
Get-VM | Get-AdvancedSetting -Name 'RemoteDisplay.maxConnections' | Select Entity, Name, Value
# Value should be <= 2

# PowerCLI — Limit console connections:
Get-VM | New-AdvancedSetting -Name 'RemoteDisplay.maxConnections' -Value '2' -Force -Confirm:$false

This recommendation verifies that SetInfo Size Limit Is Configured on the VMware vCenter 8 virtualization management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the VMware vCenter 8 virtualization management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# PowerCLI:
Get-VM | Get-AdvancedSetting -Name 'tools.setInfo.sizeLimit' | Select Entity, Name, Value
# Value should be 1048576 (1 MB)

# PowerCLI — Limit informational setinfo size:
Get-VM | New-AdvancedSetting -Name 'tools.setInfo.sizeLimit' -Value '1048576' -Force -Confirm:$false

This recommendation verifies that Unnecessary Floppy Devices Are Removed on the VMware vCenter 8 virtualization management platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the VMware vCenter 8 virtualization management platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# PowerCLI:
Get-VM | Where-Object {$_.ExtensionData.Config.Hardware.Device | Where-Object {$_ -is [VMware.Vim.VirtualFloppy]}} | Select Name
# No VMs should have floppy devices attached

# PowerCLI — Remove floppy devices:
Get-VM | ForEach-Object {
  $floppy = $_.ExtensionData.Config.Hardware.Device | Where-Object {$_ -is [VMware.Vim.VirtualFloppy]}
  if ($floppy) {
    $spec = New-Object VMware.Vim.VirtualMachineConfigSpec
    $dev = New-Object VMware.Vim.VirtualDeviceConfigSpec
    $dev.Operation = 'remove'
    $dev.Device = $floppy
    $spec.DeviceChange += $dev
    $_.ExtensionData.ReconfigVM($spec)
  }
}

This recommendation verifies that Remote Syslog Is Configured on the VMware vCenter 8 virtualization management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the VMware vCenter 8 virtualization management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# PowerCLI:
Get-AdvancedSetting -Entity (Get-VMHost) -Name 'Syslog.global.logHost' | Select Entity, Value
# Should show remote syslog server address

# PowerCLI — Set remote syslog:
Get-VMHost | ForEach-Object {
  Set-AdvancedSetting -AdvancedSetting ($_ | Get-AdvancedSetting -Name 'Syslog.global.logHost') -Value 'udp://syslog.corp.local:514' -Confirm:$false
}

This recommendation verifies that Host Log Level Is Set to Info on the VMware vCenter 8 virtualization management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the VMware vCenter 8 virtualization management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# PowerCLI:
Get-VMHost | Get-AdvancedSetting -Name 'Config.HostAgent.log.level' | Select Entity, Value
# Should be 'info' or higher

# PowerCLI — Set log level:
Get-VMHost | ForEach-Object {
  Set-AdvancedSetting -AdvancedSetting ($_ | Get-AdvancedSetting -Name 'Config.HostAgent.log.level') -Value 'info' -Confirm:$false
}

This recommendation verifies that vCenter Logs Are Being Collected on the VMware vCenter 8 virtualization management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the VMware vCenter 8 virtualization management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# vCenter Shell or VAMI:
# Check /var/log/vmware/vpxd/vpxd.log exists and is being written
ls -la /var/log/vmware/vpxd/vpxd.log
tail -5 /var/log/vmware/vpxd/vpxd.log

# Configure vCenter syslog forwarding:
# Via VAMI (https://<vcenter>:5480):
# Syslog Configuration > Add remote syslog target

# Or via dcli:
/usr/lib/vmware-vmon/vmon-cli --list | grep vpxd

This recommendation verifies that NTP Is Configured on All Hosts on the VMware vCenter 8 virtualization management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the VMware vCenter 8 virtualization management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# PowerCLI:
Get-VMHost | Get-VMHostNtpServer
# Should return configured NTP servers

Get-VMHost | Get-VMHostService | Where-Object {$_.Key -eq 'ntpd'} | Select Running, Policy

# PowerCLI — Configure NTP:
Get-VMHost | ForEach-Object {
  Add-VMHostNtpServer -VMHost $_ -NtpServer 'ntp1.corp.local'
  Add-VMHostNtpServer -VMHost $_ -NtpServer 'ntp2.corp.local'
  Get-VMHostService -VMHost $_ | Where-Object {$_.Key -eq 'ntpd'} | Start-VMHostService -Confirm:$false
  Get-VMHostService -VMHost $_ | Where-Object {$_.Key -eq 'ntpd'} | Set-VMHostService -Policy 'on'
}

This recommendation ensures that TLS 1.2 or Later Is Enforced on the VMware vCenter 8 virtualization management platform. Enforcing this requirement establishes a minimum security standard and prevents insecure configurations.

Without this enforcement, the VMware vCenter 8 virtualization management platform may accept insecure configurations that weaken overall security posture. Mandating this control ensures consistent protection against common attack vectors.

# Check TLS version:
openssl s_client -connect <vcenter>:443 -tls1_2 </dev/null 2>/dev/null | grep 'Protocol'
openssl s_client -connect <vcenter>:443 -tls1_1 </dev/null 2>/dev/null | grep 'Protocol'
# TLS 1.1 should fail, TLS 1.2 should succeed

# Via vCenter shell:
# Edit /etc/vmware-rhttpproxy/config.xml:
# Set <sslOptions> to disable TLS 1.0/1.1:
# <sslOptions>!SSLv2,!SSLv3,!TLSv1,!TLSv1.1</sslOptions>

service-control --restart vmware-rhttpproxy

This recommendation verifies that CA-Signed Certificates Are Used on the VMware vCenter 8 virtualization management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the VMware vCenter 8 virtualization management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# Check vCenter certificate:
openssl s_client -connect <vcenter>:443 </dev/null 2>/dev/null | openssl x509 -noout -issuer -subject -dates
# Verify certificate is CA-signed and not expired

# Replace with CA-signed certificate:
# 1. Generate CSR:
# /usr/lib/vmware-vmca/bin/certificate-manager
# Option 1: Replace Machine SSL Certificate
# 2. Submit CSR to CA
# 3. Import signed certificate via Certificate Manager

This recommendation verifies that Unnecessary Services Are Disabled on the VMware vCenter 8 virtualization management platform. Implementing this control strengthens the overall security configuration and reduces exposure to potential threats.

Failure to implement this control may leave the VMware vCenter 8 virtualization management platform vulnerable to attack or non-compliant with organizational security policies. This control helps establish a consistent, hardened configuration baseline.

# vCenter shell:
service-control --status --all
# Review running services — disable unnecessary ones

# Disable unnecessary services:
service-control --stop vmware-imagebuilder
service-control --stop vmware-netdumper

# Verify:
service-control --status --all

This recommendation verifies that CEIP Is Disabled on the VMware vCenter 8 virtualization management platform. Disabling or removing unnecessary components reduces the attack surface and limits potential vectors for exploitation.

Running unnecessary components on the VMware vCenter 8 virtualization management platform increases the attack surface and the risk of exploitation. Disabling or removing them follows the principle of least functionality and reduces exposure to known vulnerabilities.

# Check CEIP (Customer Experience Improvement Program):
# PowerCLI:
Get-AdvancedSetting -Entity (Get-View -ViewType OptionManager -Filter @{'Name'='VpxSettings'}) -Name 'VirtualCenter.CEIP.JoinEnabled'

# Disable CEIP:
# Via vSphere Client:
# Menu > Administration > Customer Experience Improvement Program > Leave

# Or via API:
Get-AdvancedSetting -Entity $global:DefaultVIServer -Name 'VirtualCenter.CEIP.JoinEnabled' | Set-AdvancedSetting -Value $false -Confirm:$false