VMWARE VSPHERE 6.5 ADMINISTRATION GUIDE UPDATE
VMWARE VSPHERE 6.5 ADMINISTRATION GUIDE CODE
VMWARE VSPHERE 6.5 ADMINISTRATION GUIDE DOWNLOAD

This is a corner case scenario and as such should actually have been classified as вЂњSite SpecificвЂќ. Why? Because it involves coordination with a hardware switch and the use of BPDU packets within a Windows VM. ItвЂ™s off by defaultвЂќ).ДЇor the 6.7 U1 SCG, one of the guidelines I changed from вЂњHardeningвЂќ to вЂњSite SpecificвЂќ was the вЂњvNetwork.enable-bpdu-filterвЂќ setting. вЂњSite SpecificвЂќ) or settings you should audit to ensure someone hasnвЂ™t set them to the non-default value without good reason (e.g. This was done because the number of вЂњHardeningвЂќ guidelines was eclipsed by the number of settings that VMware canвЂ™t set for you (a.k.a.

VMWARE VSPHERE 6.5 ADMINISTRATION GUIDE UPDATE

Non-Hardening Part DeuxДЄs I mentioned in the 6.5 Update 1 blog article, in 6.5 I renamed the guide from the vSphere Hardening Guide to the vSphere Security Configuration Guide. So, instead, I added content to the Vulnerability Discussion of both settings that addresses the risk discussion. That was confusing to some people and the first setting was really the only reason to keep Risk Profiles around. The companion or flip side of that was the setting вЂњESXi.enable-normal-lockdown-modeвЂќ which was Risk Profile вЂњ2,3вЂќ. The Risk Profile 1 setting was вЂњESXi.enable-strict-lockdown-modeвЂќ. The work we have been doing to deprecate settings is paying off. The value that Risk Profiles brought just wasnвЂ™t there anymore. Everything else was at either 2,3 or 1,2,3. Of the 50 remaining settings in the guide only one was at вЂњRisk Profile 1вЂќ. Now, IвЂ™m sure that this will panic many as some may consider this a big change. The second big change is that IвЂ™m sunsetting the use of вЂњRisk ProfilesвЂќ. You can safely remove these settings from your configurations. Setting them adds no value and only increases the management burden. Some customers may wish to consider these deprecated settings as вЂњAudit SettingsвЂќ, meaning that you may wish to check to see if someone has set them. Many of these settings were called out in an earlier blog from June 2017 entitled вЂњ Secure By Default вЂ“ VM.disable-unexposed-featuresвЂќ. This is a decrease from 68 in 6.5 Update 1. By sunsetting these settings and moving them out of the guide the SCG will now be only 50 settings in total. This is done to lessen the IT burden of security.ДЄll settings fitting this category are released in a separate Excel spreadsheet. We fixed them to match previous guide values so that you can stop вЂњmanagingвЂќ them.

VMWARE VSPHERE 6.5 ADMINISTRATION GUIDE CODE

There is no active code in ESXi that these settings change.

We recommend that you no longer change these settings.

This new category is called вЂњdeprecatedвЂќ. The first big change is that I have come up with a new category for settings that have been fixed in the code of ESXi or vCenter and no longer need to be manipulated anymore.

VMWARE VSPHERE 6.5 ADMINISTRATION GUIDE DOWNLOAD

Download the 6.7 Update 1 SCG spreadsheet. These changes are there to (hopefully!) make your life as the VI Admin easier. And like the 6.5 Update 1 guide, thereвЂ™s more changes that I wanted to make you aware of. Today IвЂ™m happy to announce the release of the vSphere 6.7 Update 1 Security Configuration Guide. I also covered how more settings were set to вЂњsecure by defaultвЂќ now and showed the progress between the 6.5 guide and the 6.5 Update 1 guide. I covered the topic of why some guidelines are removed or changed. At that time, I went in to detail on more than just the guide. Back in March I released the vSphere 6.5 Update 1 Security Configuration Guide (a.k.a вЂњThe SCGвЂќ).

Vmware vsphere 6.5 administration guide