Symantec Enterprise Security Manager Modules for ESX and ESXi server User Guide

Transcription

1 Symantec Enterprise Security Manager Modules for ESX and ESXi server User Guide Release 2.0 for Symantec ESM 9.0.x and 10.0 For ESX and ESXi servers with support for reporting on vcenter server

2 Symantec Enterprise Security Manager Modules for ESX and ESXi server User Guide The software described in this book is furnished under a license agreement and may be used only in accordance with the terms of the agreement. Documentation version: 2.0 Legal Notice Copyright 2010 Symantec Corporation. All rights reserved. Symantec, the Symantec Logo, ActiveAdmin, BindView, bv-control, and LiveUpdate are registered trademarks of Symantec Corporation or its affiliates in the U.S. and other countries. Other names may be trademarks of their respective owners. This Symantec product may contain third party software for which Symantec is required to provide attribution to the third party ( Third Party Programs ). Some of the Third Party Programs are available under open source or free software licenses. The License Agreement accompanying the Software does not alter any rights or obligations you may have under those open source or free software licenses. Please see the Third Party Legal Notice Appendix to this Documentation or TPIP ReadMe File accompanying this Symantec product for more information on the Third Party Programs. The product described in this document is distributed under licenses restricting its use, copying, distribution, and decompilation/reverse engineering. No part of this document may be reproduced in any form by any means without prior written authorization of Symantec Corporation and its licensors, if any. THE DOCUMENTATION IS PROVIDED "AS IS" AND ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE DISCLAIMED, EXCEPT TO THE EXTENT THAT SUCH DISCLAIMERS ARE HELD TO BE LEGALLY INVALID. SYMANTEC CORPORATION SHALL NOT BE LIABLE FOR INCIDENTAL OR CONSEQUENTIAL DAMAGES IN CONNECTION WITH THE FURNISHING, PERFORMANCE, OR USE OF THIS DOCUMENTATION. THE INFORMATION CONTAINED IN THIS DOCUMENTATION IS SUBJECT TO CHANGE WITHOUT NOTICE. The Licensed Software and Documentation are deemed to be commercial computer software as defined in FAR and subject to restricted rights as defined in FAR Section "Commercial Computer Software - Restricted Rights" and DFARS , "Rights in Commercial Computer Software or Commercial Computer Software Documentation", as applicable, and any successor regulations. Any use, modification, reproduction release, performance, display or disclosure of the Licensed Software and Documentation by the U.S. Government shall be solely in accordance with the terms of this Agreement.

3 Symantec Corporation 350 Ellis Street Mountain View, CA

4 Technical Support Contacting Technical Support Symantec Technical Support maintains support centers globally. Technical Support s primary role is to respond to specific queries about product features and functionality. The Technical Support group also creates content for our online Knowledge Base. The Technical Support group works collaboratively with the other functional areas within Symantec to answer your questions in a timely fashion. For example, the Technical Support group works with Product Engineering and Symantec Security Response to provide alerting services and virus definition updates. Symantec s support offerings include the following: A range of support options that give you the flexibility to select the right amount of service for any size organization Telephone and/or web-based support that provides rapid response and up-to-the-minute information Upgrade assurance that delivers software upgrades Global support purchased on a regional business hours or 24 hours a day, 7 days a week basis Premium service offerings that include Account Management Services For information about Symantec s support offerings, you can visit our web site at the following URL: All support services will be delivered in accordance with your support agreement and the then-current enterprise technical support policy. Customers with a current support agreement may access Technical Support information at the following URL: Before contacting Technical Support, make sure you have satisfied the system requirements that are listed in your product documentation. Also, you should be at the computer on which the problem occurred, in case it is necessary to replicate the problem. When you contact Technical Support, please have the following information available: Product release level

5 Hardware information Available memory, disk space, and NIC information Operating system Version and patch level Network topology Licensing and registration Customer service Router, gateway, and IP address information Problem description: Error messages and log files Troubleshooting that was performed before contacting Symantec Recent software configuration changes and network changes If your Symantec product requires registration or a license key, access our technical support web page at the following URL: Customer service information is available at the following URL: Customer Service is available to assist with non-technical questions, such as the following types of issues: Questions regarding product licensing or serialization Product registration updates, such as address or name changes General product information (features, language availability, local dealers) Latest information about product updates and upgrades Information about upgrade assurance and support contracts Information about the Symantec Buying Programs Advice about Symantec's technical support options Nontechnical presales questions Issues that are related to CD-ROMs or manuals

6 Support agreement resources If you want to contact Symantec regarding an existing support agreement, please contact the support agreement administration team for your region as follows: Asia-Pacific and Japan Europe, Middle-East, and Africa North America and Latin America Additional enterprise services Symantec offers a comprehensive set of services that allow you to maximize your investment in Symantec products and to develop your knowledge, expertise, and global insight, which enable you to manage your business risks proactively. Enterprise services that are available include the following: Managed Services Consulting Services Education Services Managed Services remove the burden of managing and monitoring security devices and events, ensuring rapid response to real threats. Symantec Consulting Services provide on-site technical expertise from Symantec and its trusted partners. Symantec Consulting Services offer a variety of prepackaged and customizable options that include assessment, design, implementation, monitoring, and management capabilities. Each is focused on establishing and maintaining the integrity and availability of your IT resources. Education Services provide a full array of technical training, security education, security certification, and awareness communication programs. To access more information about enterprise services, please visit our web site at the following URL: Select your country or language from the site index.

7 Contents Technical Support... 4 Chapter 1 Chapter 2 Introducing Symantec ESM Modules for ESX, ESXi, & vcenter servers... 9 About the Symantec ESM Modules for ESX, ESXi, & vcenter servers... 9 Where you can get more information Templates Installing Symantec ESM Modules for ESX, ESXi, & vcenter servers Before you install Minimum account privileges System requirements Disk space requirements Installing and configuring the ESM Modules for ESX, ESXi, and vcenter server Silently installing the ESM modules for ESX server Silently configuring the ESM modules for ESX, ESXi, vcenter server Configuring the ESM modules for ESX, ESXi, vcenter server About types of configuration Chapter 3 ESM Modules for ESX and ESXi servers ESX Configurations About reporting through the vcenter server Guest installed Guest status Copy disabled Paste disabled Setinfo messages disabled Guest time synchronization Guest connection control Host time synchronization... 31

8 8 Contents Guest logging VMware Tools logging Guest log rotate size Guest old log keeping Set GUI Options disabled Host config option parameters NX/XD flag exposed to guest ESX Network About reporting through the vcenter server iscsi enabled iscsi CHAP authentication MAC address changes Forged transmission Promiscuous mode Service console firewall Port groups in VLAN SNMP traps setting ESX Patches About reporting through the vcenter server Patch templates Superseded Disable patch module Patch results summary Installed Patches ESXi updates ESX System About reporting through the vcenter server GRUB OS level password Boot loader password Root file system fill up Roles and privileges SU PAM Authentication ESX log auditing Execute on vcenter Lockdown mode Local accounts only Shell access Maintenance mode List users and groups... 50

9 Chapter 1 Introducing Symantec ESM Modules for ESX, ESXi, & vcenter servers This chapter includes the following topics: About the Symantec ESM Modules for ESX, ESXi, & vcenter servers Where you can get more information Templates About the Symantec ESM Modules for ESX, ESXi, & vcenter servers The Symantec ESM modules for ESX, ESXi, & vcenter servers include the following four modules: ESX Configuration ESX Network ESX Patches ESX System The ESX modules help to protect your ESX and ESXi servers from known security vulnerabilities by reporting the differences between the preferred and the actual setting on these servers. ESX version 3.0.2, 3.0.3, 3.5, and 4.0 supports host-based reporting. For network-based reporting, you must ensure that the ESX modules must be installed

10 10 Introducing Symantec ESM Modules for ESX, ESXi, & vcenter servers Where you can get more information on an ESM agent computer that is running on a Red Hat Enterprise Linux server. You can then configure the ESX, ESXi, and vcenter servers that you want to report on. Where you can get more information For more information about Symantec ESM modules and Security Updates, see the latest versions of the Symantec Enterprise Security Administrator s Guide and the Symantec ESM Security Update User Guide. For more information on Symantec Enterprise Security Manager (ESM), Symantec ESM Security Updates, and Symantec ESM support for database products, see the Symantec Security Response Web site at the following URL: Security Response Web site Templates Several of the documented modules use templates to store the ESX parameters and object settings. Differences between the current settings and template values are reported when the modules run. Modules use templates to store ESX and ESXi servers parameters and object settings. Table 1-1 shows the modules and checks that use template files in Symantec ESM Modules for ESX, ESXi, & vcenter servers. Table 1-1 Template names Module Check name Template name Predefined template ESX Configurations Host config option parameters ESX Configuration Parameters esxdefaultconf.cox ESX Patches Patch templates esxpatch.elx esxpatch.elx ESX Patches ESXi updates ESXi Patch esxipatch.ilx ESX Network Port groups in VLAN ESX Port group in VLAN none ESX System ESX log auditing ESX log audit none Table 1-2 shows the modules and checks that use sample template files.

11 Introducing Symantec ESM Modules for ESX, ESXi, & vcenter servers Templates 11 Table 1-2 Module ESX Network ESX System Sample template names Check name Port groups in VLAN ESX log auditing Sample template esxgrpvlan_sample.lan esxlogaudit_sample.evt Note: The sample templates are for reference only. You can use the sample templates to create customized templates for the check to report on the values that you specify in the template.

12 12 Introducing Symantec ESM Modules for ESX, ESXi, & vcenter servers Templates

13 Chapter 2 Installing Symantec ESM Modules for ESX, ESXi, & vcenter servers This chapter includes the following topics: Before you install Minimum account privileges System requirements Disk space requirements Installing and configuring the ESM Modules for ESX, ESXi, and vcenter server Silently installing the ESM modules for ESX server Silently configuring the ESM modules for ESX, ESXi, vcenter server Configuring the ESM modules for ESX, ESXi, vcenter server Before you install When an ESX server is installed, the default firewall setting block s the incoming and the outgoing ports. To establish communication between the ESM manager and the ESM agent, which is installed on the ESX server, open the ports 5600 and 5601 before you install the ESM agent on the ESX server. To install the modules, you need the following:

14 14 Installing Symantec ESM Modules for ESX, ESXi, & vcenter servers Minimum account privileges CD-ROM access Account privileges Connection to the manager Agent and manager At least one computer on your network must have a CD-ROM drive. You must have access to an account with superuser privileges on each computer where you plan to install the modules. Verify that the Symantec ESM enterprise console can connect to the Symantec ESM manager. The Symantec ESM agent must be running and registered to at least one Symantec ESM manager. Minimum account privileges You can use the following minimum account privileges for installation and reporting: Minimum privileges to install the ESM ESX Modules You must have superuser privileges to install the ESM ESX Modules on ESX host and Red Hat Enterprise Linux. For example, root. Minimum account privileges for reporting on the vcenter, ESX and ESXi 3.5 or later You must configure the ESM ESX modules with ESX or ESXi or vcenter server so that an ESM policy with ESX modules and appropriate checks selected, can be executed on the configured servers. During configuration, you must provide the server details like server name or the IP address and the name of the user account that has the appropriate privileges or permissions on the server that you provide. This user account is used as the logon account to connect to the respective ESX or ESXi or vcenter server. The configuration details are provided on the execution of the esxsetup binary. The minimum permission required for the configured user account should have a role with Global.Diagnostic privilege assigned to it. For example, precreated user. For more information on how to run the esxsetup, See Installing and configuring the ESM Modules for ESX, ESXi, and vcenter server on page 16. Note: While you configure the server with domain\user, you must enclose the value in single quotes as 'domain\user'.

15 Installing Symantec ESM Modules for ESX, ESXi, & vcenter servers System requirements 15 Warning: If you use less than the recommended privileges for the accounts that the ESX Application module uses for reporting, then a few checks may not function correctly. This could also result in any intentional or unintentional blocking of the module's ability to report on the conditions you may need to know exists. System requirements Table 2-1 list the supported ESX server versions for host-based reporting. Note: As per Symantec's End of Life product support policy, the ESM Modules for ESX servers are only supported on ESX version till August Table 2-1 Architecture x86, x86_64 Supported ESX server versions for host-based reporting Supported ESX versions 3.0.2, 3.0.3, 3.5, 4.0, 4.1 Note: The host-based reporting works only on the ESX server. Table 2-2 lists the supported ESX, ESXi, and vcenter server versions and operating systems for network-based reporting. Table 2-2 Supported ESX, ESXi, and vcenter server versions and operating systems for network-based reporting Supported operating systems Supported OS versions Architecture Supported ESX versions Red Hat Enterprise Linux ES (32-bit) 5.1, 5.2, 5.3, 5.4 x86 3.5, 3.5i, 4.0, 4.0i, 4.1, 4.1i vcenter server update 4.0.x Red Hat Enterprise Linux ES (64-bit) 5.1, 5.2, 5.3, 5.4 x64 3.5, 3.5i, 4.0, 4.0i, 4.1, 4.1i vcenter server update 4.0.x Note: vcenter server update 4, which is installed on the Windows 2003 (x86, x64) and 2008 (x86, x64) platform supports network-based reporting.

16 16 Installing Symantec ESM Modules for ESX, ESXi, & vcenter servers Disk space requirements Disk space requirements Table 2-3 lists the free disk space that you require to install the ESM modules for ESX server. Table 2-3 Disk space requirements Supported operating system ESX 3.0.2, 3.0.3, 3.5, 4.0, 4.1 Red Hat Enterprise Linux ES (32-bit and 64-bit) Architecture x86, x86_64 x86, x64 Disk space 170 MB 170 MB Installing and configuring the ESM Modules for ESX, ESXi, and vcenter server You can use the esmesx.tpi to install the ESX module on the ESM agent computer. The installation program does the following: Extracts and installs module executables, configuration (.m) files, and the template files. Registers the.m and the template files by using the ESM agent s registration program. Note: If you register the.m files during a module installation on an agent that is installed on the same platform, then you do not have to re-register the.m files. Launches the esxsetup for configuration.

17 Installing Symantec ESM Modules for ESX, ESXi, & vcenter servers Installing and configuring the ESM Modules for ESX, ESXi, and vcenter server 17 To install the ESM modules for ESX, ESXi, vcenter server 1 From the product disc, run the esmesx.tpi. You can also download and copy the esmesx.tpi from the Security Response Web site to the desired location. Note: You can use the LiveUpdate feature, if you want to upgrade the existing ESX version to the latest ESX version. For more information on LiveUpdate, you can refer to the Symantec Enterprise Security Manager Installation Guide. 2 Choose one of the following options: Option 1 Option 2 To display the contents of the package. To install the module. 3 The Do you wish to register the template or.m files? message appears. Do one of the following: Type a Y, if the files are not registered with the manager. Type an N, if the files have already been registered. See To configure the ESX, ESXi, vcenter servers on the ESM agent computers on page 18. See To configure for the ESX, ESXi, vcenter by using generic credentials on page 19. Note: You must register the template and the.m files once for the agents that use the same manager on the same operating system. 4 Enter the ESM manager that the agent is registered to. Usually, it is the name of the computer that the manager is installed on. 5 Enter the ESM access name (logon name) for the manager. 6 Enter the ESM password that is used to log on to the ESM manager. 7 Enter the network protocol that is used to contact the ESM manager. 8 Enter the port that is used to contact the ESM Manager. The default port is Enter the name of the agent as it is currently registered to the ESM manager. Usually, it is the name of the computer that the agent is installed on.

18 18 Installing Symantec ESM Modules for ESX, ESXi, & vcenter servers Installing and configuring the ESM Modules for ESX, ESXi, and vcenter server Type a Y, the agent continues with the registration to the ESM manager. Type an N, the setup prompts to re-enter the details of the new manager. When the extraction is complete, you are prompted to add configuration records to enable the ESM security checking for your ESX server. 10 The Continue and add configuration records to enable ESM security checking for your servers? [yes] message appears. Do one of the following: Type a Y, to configure the ESX module on the agent computer. Type an N, the program installation continues without configuration. To configure the ESX, ESXi, vcenter servers on the ESM agent computers 1 To add a configuration record for the server, do the following: Enter the server name or IP. Enter an option to choose the connection mode. It can either be HTTP or https. Press Enter to select the default port or enter a custom port. 2 Enter the logon account for the server. See Minimum account privileges on page Enter the password for the logon account. 4 Re-type the password for confirmation. 5 The Do you want to specify a server certificate for client authentication? [yes] message appears. Do one of the following: Type a Y, if you want to specify a server certificate for client authentication. You must enter the complete path of the certificate file that must exist on your ESM agent computer. You can download the certificate file from ESX, ESXi, or vcenter server. Type an N, if you do not want to specify a server certificate for client authentication. 6 The Do you want to validate the connection before saving the configuration record? [yes] message appears. Type a Y, if you want to validate the connection. If the validation is not successful, then the installation program reports an error message and the record is not added to the configuration record.

19 Installing Symantec ESM Modules for ESX, ESXi, & vcenter servers Installing and configuring the ESM Modules for ESX, ESXi, and vcenter server 19 Type an N, if you do not want to validate the connection. 7 The Would you like to add another ESX server to configuration record? message appears. Type a Y, if you want to add another server. Type an N, if you want to end the installation program. To configure for the ESX, ESXi, vcenter by using generic credentials 1 The Do you want this record to be configured to use generic credentials? [no] message appears. Do one of the following: Type a Y, if you want the record to be configured to use generic credentials. The installation program displays a warning message to configure the generic credentials if you have not yet configured them. Type an N, if you do not want the record to be configured to use generic credentials. 2 The Do you want to specify a server certificate for client authentication? [yes] message appears. Do one of the following: Type a Y, if you want to specify a server certificate for client authentication. You must enter the complete path of the certificate file that must exist on your ESM agent computer. Type an N, if you do not want to specify a server certificate for client authentication. 3 The Do you want to validate the connection before saving the configuration record? [yes] message appears. Type a Y, if you want to validate the connection. If the validation is not successful, then the installation program reports an error message and the record is not added to the configuration record. Type an N, if you do not want to validate the connection. 4 The Would you like to add another ESX server to configuration record? message appears. Type a Y, to add another server record. If you type an N, the configuration exits, and the setup continues with the installation program. After you have created the configuration records for each ESX server, the program lists all of the configuration records.

20 20 Installing Symantec ESM Modules for ESX, ESXi, & vcenter servers Silently installing the ESM modules for ESX server Silently installing the ESM modules for ESX server You can use the esmesx.tpi to install the ESM ESX module silently. Table 2-4 lists the command line options for silently installing the ESM modules on ESX server. Table 2-4 Option -h -d -i -f -U -e -P -p -m -t -g -K -L -N -Y Options to silently install the ESM modules on ESX server Description Display Help. Display the description and contents of this tune-up/third-party package. Install this tune-up/third-party package. Force an installation of the package. Specify the ESM user name. Skip the configuration during installation. Specify the ESM user s password. Specify the TCP port to use. Specify the ESM manager name. Connect to the ESM manager by using TCP. Specify the ESM agent name to use for re-registration. Do not prompt for nor do the re-registration of the agents. Specify the application name. Do not update the report content file on the manager. Update the report content file on the manager. Silently configuring the ESM modules for ESX, ESXi, vcenter server You can use the esxsetup to silently configure the ESM modules for the server. You can find the esxsetup at /esm/bin/<os architecture>/esxsetup. Table 2-5 lists the options for silently configuring the ESM modules for the server.

21 Installing Symantec ESM Modules for ESX, ESXi, & vcenter servers Configuring the ESM modules for ESX, ESXi, vcenter server 21 Table 2-5 Option -S -M -p -sv -g -L -P -C Options to silently configure the ESM modules for ESX, ESXi, vcenter server Description Specify the server host name or IP. Specify the connection mode [HTTP or https]. Specify the port where the HTTP or https is configured or the connection mode will use the default ports. Skip connection validation. If you specify this option, then the generic credentials are used to logon to the respective server. Specify the authorized logon account. Provide the password for the specified logon account. Specify the name and the path of the certificate file for client authentication. Without this certificate the client authentication will not be used. For example,./esxsetup -S server -M mode [-p port] [-sv] {-g -L login -P password} [-C certpath] Note: If you do not specify any option then./esxsetup runs with the -h option. Configuring the ESM modules for ESX, ESXi, vcenter server You can use the esxsetup to configure the ESM modules for the server. You can find the esxsetup at /esm/bin/<os architecture>/esxsetup. Configuration is a method by which Application module save information about the servers it has to report on. Table 2-6 lists the options to configure the ESM modules interactively.

22 22 Installing Symantec ESM Modules for ESX, ESXi, & vcenter servers Configuring the ESM modules for ESX, ESXi, vcenter server Table 2-6 Option -h -c -l -a -m -G -rg -gif -gof Options to configure the ESM modules for ESX, ESXi, vcenter server interactively Description Display Help. Create configuration records for the servers that should be scanned. Note: This option overwrites the existing configuration file. List all the configured servers. Add new configuration records for the servers that should be scanned. Modify the existing configuration records of the server. Add the configuration record for the generic credentials. Remove the generic credential information. Specify the file name that contains the encrypted generic credentials. Specify the file name where you save the encrypted generic credentials. For example,./esxsetup : [-h -c -l -a -m -G -rg -gif gen_cred_file -gof gen_cred_file] About types of configuration This section gives information on the ESM agents that you can configure by adding the ESX/ESXi/vCenter server to the ESX configuration file of ESM. You are not required to configure the ESX or ESXi servers with the ESM ESX Application Modules if they are being managed by the vcenter server provided this vcenter server is configured with the ESM ESX Application Modules. Table 2-7 lists the types of configuration. Table 2-7 Types of configuration Agent OS Version Support for host-based reporting Support for network-based reporting Red Hat Enterprise Linux (x86 and x64) 5.1, 5.2, 5.3, 5.4 No **Yes (Configuration required)

23 Installing Symantec ESM Modules for ESX, ESXi, & vcenter servers Configuring the ESM modules for ESX, ESXi, vcenter server 23 Table 2-7 Types of configuration (continued) Agent OS Version Support for host-based reporting Support for network-based reporting ESX 3.0.2, Yes (No configuration required) No ESX 3.5, 4.0, 4.1 Yes (Configuration required) Yes (Configuration required) Note: ** Symantec recommends this approach.

24 24 Installing Symantec ESM Modules for ESX, ESXi, & vcenter servers Configuring the ESM modules for ESX, ESXi, vcenter server

25 Chapter 3 ESM Modules for ESX and ESXi servers This chapter includes the following topics: ESX Configurations ESX Network ESX Patches ESX System ESX Configurations The ESX Configurations module reports the configuration information of the ESX and ESXi servers and the guest operating systems. Symantec recommends that you must ensure that the server configurations and the guests are as per your security policies. The properties that are referred by the ESM ESX modules for the ESX and ESXi 3.5 or later versions along with their Managed Object Browser (MOB) paths have been provided for the individual checks. Note: While processing the vcenter server, modules skip the host systems that are in a disconnected state. This happens because queries from the vcenter server to disconnected hosts system retrieve old data instead of live data, which is incorrect and does not reflect the correct values.

26 26 ESM Modules for ESX and ESXi servers ESX Configurations About reporting through the vcenter server Guest installed In order to report through the vcenter server, you must first register the ESX and ESXi servers with it. You can configure the vcenter server with the application module in the same way you configure the ESX or ESXi servers. When you run the ESX Application module on the agent where the vcenter server is configured, the module fetches the information of the hosts that are registered with the vcenter server. Certain information from the ESX/ ESXi hosts is not available at vcenter server, like local users etc. This information can be reported by the ESX Application module only when the respective host is directly configured in the ESX configuration file of ESM. This check reports a list of guests that are installed and their configuration path if the name list is blank. If you specify a disallowed directory name in the name list, then it reports the guests that are installed under the specified directory. The check refers to the following properties: config.datastoreurl Use the Managed Object Browser(MOB) to view the property of the respective virtual machines. You can navigate through [VirtualMachine] > config > datastoreurl path to view the property. summary.config Use the Managed Object Browser(MOB) to view the property of the respective virtual machines. You can navigate through [VirtualMachine] > summary > config > vmpathname to view the property. Note: [VirtualMachine] is the Managed Object Reference to a virtual machine. Table 3-1 lists the messages for this check. Table 3-1 Guest installed check messages STKU_INSTLGUEST STKU_DISALLOWDIR Guest installed Disallowed directory Green (0)

27 ESM Modules for ESX and ESXi servers ESX Configurations 27 Guest status This check reports on the state and heartbeats of all the guests. The state can be powered OFF, powered ON, or suspended and the heartbeats can be Gray, Green, Yellow, or Red. On ESX 3.0.2, the heartbeats can be alive or dead. To determine the guest status, the check refers to the runtime.powerstate property. Use the Managed Object Browser (MOB) to view the property of the respective virtual machines. You can navigate through [VirtualMachine] > runtime > powerstate to view the property. To determine the heart beat status, the check refers to the runtime.powerstate property. Use the Managed Object Browser (MOB) to view the property of the respective virtual machines. You can navigate through [VirtualMachine] > summary > quickstats > guestheartbeatstatus to view the property. Note: [VirtualMachine] is the Managed Object Reference to a virtual machine. Table 3-2 lists the messages for this check. Table 3-2 Guest status check messages STKU_GUESTSTATUS Guest status Green (0) Copy disabled This check verifies if the copying operation is disabled for the guest. The properties and conditions that the check verifies for reporting are as follows: Both the isolation.tools.copy.disable property and isolation.tools.copy.enable properties are not defined. Either the isolation.tools.copy.disable property is set to false or the isolation.tools.copy.enable property is set to true. Both the isolation.tools.copy.disable property and the isolation.tools.copy.enable property are set to false. Both the isolation.tools.copy.disable property and isolation.tools.copy.enable property are set to true.

28 28 ESM Modules for ESX and ESXi servers ESX Configurations Note: The check has been modified to report a different message if it does not find any of the properties configured. If you have applied any suppression in the Information field, then the message reappears with the new information. Use the Managed Object Browser (MOB) to view the isolation.tools.copy.enable and isolation.tools.copy.disable properties of the respective virtual machine. You can navigate through [VirtualMachine] > config > extraconfig to view the property. Note: [VirtualMachine] is the Managed Object Reference to a virtual machine. Table 3-3 lists the messages for this check. Table 3-3 STKU_COPY Copy disabled check messages Copy enabled Paste disabled This check verifies if the pasting operation is disabled for the guest. The properties and conditions that the check verifies for reporting are as follows: Both the isolation.tools.paste.disable and isolation.tools.paste.enable properties are not defined. Either the isolation.tools.paste.disable property is set to false or the isolation.tools.paste.enable property is set to true. Both the isolation.tools.paste.disable property and the isolation.tools.copy.paste property are set to false. Both the isolation.tools.paste.disable property and the isolation.tools.paste.enable property are set to true. Note: The check has been modified to report a different message if it does not find any of the properties configured. If you have applied any suppression in the Information field, then the message reappears with the new information. Use the Managed Object Browser(MOB) to view the isolation.tools.paste.disable and isolation.tools.paste.enable properties of the respective virtual machine. You can navigate through [VirtualMachine] > config > extraconfig to view the property.

29 ESM Modules for ESX and ESXi servers ESX Configurations 29 Note: [VirtualMachine] is the Managed Object Reference to a virtual machine. Table 3-4 lists the messages for this check. Table 3-4 STKU_PASTE Paste disabled check messages Paste enabled Setinfo messages disabled This check verifies if Setinfo messages are disabled for the guest. The properties and conditions that the check verifies for reporting are as follows: Both the isolation.tools.setinfo.disable and isolation.tools.setinfo.enable properties are not defined. Either the isolation.tools.setinfo.disable property is set to false or the isolation.tools.setinfo.enable property is set to true. Both the isolation.tools.setinfo.disable property and the isolation.tools.setinfo.enable property are set to false. Both the isolation.tools.setinfo.disable property and the isolation.tools.setinfo.enable property are set to true. Note: The check has been modified to report a different message if it does not find any of the properties configured. If you have applied any suppression in the Information field, then the message reappears with the new information. Use the ManagedObjectBrowser(MOB) to view the isolation.tools.setinfo.disable and isolation.tools.setinfo.enable properties of the respective virtual machine. You can navigate through [VirtualMachine] > config > extraconfig to view the property. Note: [VirtualMachine] is the Managed Object Reference to a virtual machine. Table 3-5 lists the messages for this check. Table 3-5 Setinfo messages disabled check messages STKU_SETINFO Setinfo enabled

30 30 ESM Modules for ESX and ESXi servers ESX Configurations Guest time synchronization This check verifies if time synchronization is enabled between the guest and the ESX server. The check verifies if the config.tools.synctimewithhost property is set to false. Use the Managed Object Browser (MOB) to view the config.tools.synctimewithhost property of the respective virtual machine. You can navigate through [VirtualMachine] > config > tools > synctimewithhost to view the property. Note: [VirtualMachine] is the Managed Object Reference to a virtual machine. Table 3-6 lists the messages for this check. Table 3-6 Guest time synchronization check messages STKU_TIMESYNC Guest time not synchronized Guest connection control This check reports the name of the devices that can be connected or disconnected by the guest. To determine the set of virtual devices that are present on the guest OS, the check refers to the config.hardware.device property. Use the Managed Object Browser (MOB) to view the property of the respective virtual machines. You can navigate through [VirtualMachine] > config > hardware > device to view the property. Note: [VirtualMachine] is the Managed Object Reference to a virtual machine. Table 3-7 lists the messages for this check. Table 3-7 Guest connection control check messages STKU_GUESTCONNCTRL Guest connection control

31 ESM Modules for ESX and ESXi servers ESX Configurations 31 Host time synchronization This check verifies if the ntpd service is running on the host system. On ESX and ESX 3.0.3, this check also reports if the time difference between the host and the time server exceeds the specified limit (in seconds). For the check to calculate the time difference, you must specify the time server, IP address, and time offset as IP:Offset. For example, : The check refers to the config.service.service ["ntpd"] property to validate the presence and status of the ntpd service. Use the Managed Object Browser (MOB) to view the config.service.service ["ntpd"] property of the respective host system. You can navigate through [HostSystem] > config > service to view the property. Note: [HostSystem] is the Managed Object Reference to a host system. Table 3-8 lists the messages for this check. Table 3-8 Host time synchronization check messages STKU_NTPDSTOPPED STKU_OFFSETEXCEEDED ntpd not running Offset exceeded Guest logging This check verifies if the Guest logging is disabled. The check verifies if the config.flags.enablelogging property is set to true. Use the Managed Object Browser (MOB) to view the config.flags.enablelogging property of the respective virtual machine. You can navigate through [VirtualMachine] > config > flags > enablelogging to view the property. Note: [VirtualMachine] is the Managed Object Reference to a virtual machine. Table 3-9 lists the messages for this check. Table 3-9 Guest logging check messages STKU_GUESTLOGGING Guest logging

32 32 ESM Modules for ESX and ESXi servers ESX Configurations VMware Tools logging This check verifies if the VMware Tools logging is disabled. The properties and conditions that the check verifies for reporting are as follows: Both the isolation.tools.log.disable and isolation.tools.log.enable properties are not defined. Either the isolation.tools.log.disable property is set to false or the isolation.tools.log.enable property is set to true. Both the isolation.tools.log.disable property and the isolation.tools.log.enable property are set to false. Both the isolation.tools.log.disable property and the isolation.tools.log.enable property is set to true. Note: The check has been modified to report a different message if it does not find any of the properties configured. If you have applied any suppression in the Information field, then the message reappears with the new information. Use the Managed Object Browser (MOB) to view the isolation.tools.log.disable and isolation.tools.log.enable properties of the respective virtual machine. You can navigate through [VirtualMachine] > config > extraconfig to view the property. Note: [VirtualMachine] is the Managed Object Reference to a virtual machine. Table 3-10 lists the messages for this check. Table 3-10 VMware Tools logging check messages STKU_VMTOOLSLOGGING VMware Tools logging Guest log rotate size This check verifies whether the log rotate size is not greater than the value that you specify in the Maximum size in KB text box. To determine the log rotate size, the check refers to the config.extraconfig["log.rotatesize"] property. Use the Managed Object Browser (MOB) to view the config.extraconfig["log.rotatesize"] property of the respective virtual machine.

33 ESM Modules for ESX and ESXi servers ESX Configurations 33 You can navigate through [VirtualMachine] > config > extraconfig to view the property. Note: [VirtualMachine] is the Managed Object Reference to a virtual machine. Table 3-11 lists the messages for this check. Table 3-11 Guest log rotate size check messages STKU_LOGROTATESIZE Guest log rotate size Guest old log keeping This check verifies whether the log rotate size is not greater than the value that you specify in the number of log files to keep text box. To determine the log rotate size, the check refers to the config.extraconfig["log. keepold"] property. Use the Managed Object Browser (MOB) to view the config.extraconfig["log.keepold"] property of the respective virtual machine. You can navigate through [VirtualMachine] > config > extraconfig to view the property. Note: [VirtualMachine] is the Managed Object Reference to a virtual machine. Table 3-12 lists the messages for this check. Table 3-12 Guest old log keeping check messages STKU_OLDLOGKEEPING Guest old log keeping Set GUI Options disabled This check verifies if the Set GUI Options is disabled for the guest. The properties and conditions that the check verifies for reporting are as follows: Both the isolation.tools.setguioptions.disable and isolation.tools.setguioptions.enable properties are not defined.

34 34 ESM Modules for ESX and ESXi servers ESX Configurations Either the isolation.tools.setguioptions.disable property is set to false or the isolation.tools.setguioptions.enable property is set to true. Both the isolation.tools.setguioptions.disable property and the isolation.tools.setguioptions.enable property are set to false. Both the isolation.tools.setguioptions.disable property and the isolation.tools.setguioptions.enable property are set to true. Note: The check has been modified to report a different message if it does not find any of the properties configured. If you have applied any suppression in the Information field, then the message reappears with the new information. Use the Managed Object Browser (MOB) to view the isolation.tools.setguioptions.disable and isolation.tools.setguioptions.enable properties of the respective virtual machine. You can navigate through [VirtualMachine] > config > extraconfig to view the property. Note: [VirtualMachine] is the Managed Object Reference to a virtual machine. Table 3-13 lists the messages for this check. Table 3-13 Set GUI Options disabled check messages STKU_SETGUI Set GUI Options enabled Host config option parameters This check reports the unauthorized values for the configuration parameters that are specified in the enabled ESX/ESXi Host Configuration Parameters template. This check is not supported on ESX and ESX servers. Table 3-14 lists the messages for this check. Table 3-14 Host config option parameters messages ESM_ESX_CONFIG_ OPT_GREEN_LEVEL ESM_ESX_CONFIG_ OPT_YELLOW_LEVEL Unauthorized configuration parameter (Green level) Unauthorized configuration parameter (Yellow level) Green (0)

35 ESM Modules for ESX and ESXi servers ESX Configurations 35 Table 3-14 Host config option parameters messages (continued) ESM_ESX_CONFIG_ OPT_RED_LEVEL ESM_ESX_CONFIG_ OPT_NOT_FOUND ESM_ESX_CONFIG_ OPT_NOT_SUPPORTED Unauthorized configuration parameter (Red level) Configuration parameter not found Unsupported configuration parameter Red (4) Green (0) NX/XD flag exposed to guest For more information on the template see, Symantec Enterprise Security Manager Modules for ESX and ESXi server Release Notes. This check verifies if the NX flag is exposed to the guest OS. The check verifies the CPUID identification mask structures. The check assess the CPUID identification mask that has its level set as (Hex value 0x ). The check reports a violation message if the structure does not have the 20th MSB of the edx register set to value 1 or H. The check does not report any violation message, if it finds the cpufeaturemask property not set. By default, the NX/XD flag is exposed to the guest OS. Use the Managed Object Browser (MOB) to view the cpufeaturemask property for the virtual machine. You can navigate through [Virtual Machine] > config > cpufeaturemask to view the property. Note: [VirtualMachine] is the Managed Object Reference to a virtual machine. Table 3-15 lists the messages for this check. Table 3-15 NX/XD flag exposed to guest messages ESM_ESX_NX_XD_ FLAD_NOT_EXPOSED ESM_ESX_NX_XD_ FLAD_EMPTY_VAL NX/XD flag hidden from guest OS NX/XD flag set to implicit empty value Green (0)

36 36 ESM Modules for ESX and ESXi servers ESX Network ESX Network The ESX Network module reports information about the network configuration of the ESX and ESXi servers. It lets you verify if these servers are compliant with your security standards. The properties that are referred by the ESM ESX modules for the ESX and ESXi 3.5 or later versions along with their Managed Object Browser (MOB) paths have been provided for the individual checks. Note: While processing the vcenter server, modules skip the host systems that are in a disconnected state. This happens because queries from the vcenter server to disconnected hosts system retrieve old data instead of live data, which is incorrect and does not reflect the correct values. About reporting through the vcenter server In order to report through the vcenter server, you must first register the ESX and ESXi servers with it. You can configure the vcenter server with the application module in the same way you configure the ESX or ESXi servers. When you run the ESX Application module on the agent where the vcenter server is configured, the module fetches the information of the hosts that are registered with the vcenter server. Certain information from the ESX/ ESXi hosts is not available at vcenter server, like local users etc. This information can be reported by the ESX Application module only when the respective host is directly configured in the ESX configuration file of ESM. iscsi enabled This check verifies if iscsi is enabled on the host system. To determine if iscsi is enabled on the host system, the check refers to the softwareinternetscsienabled property. Use the Managed Object Browser (MOB) to view the config.storagedevice. softwareinternetscsienabled property for the host system. You can navigate through [HostSystem] > config > storagedevice > softwareinternetscsienabled to view the property. Note: [HostSystem] is the Managed Object Reference to a host system. Table 3-16 lists the messages for this check.

37 ESM Modules for ESX and ESXi servers ESX Network 37 Table 3-16 iscsi enabled check messages STKU_ISCSIDISABLED iscsi disabled iscsi CHAP authentication This check verifies that if iscsi is enabled on the host system then iscsi CHAP authentication should also be enabled. To determine if the iscsi CHAP authentication is enabled on the host system, the check refers to the hostbusadapter["key-vim.host.internetscsihba-*"] and chapauthenabled properties of the host system. Use the Managed Object Browser (MOB) to view the authentication and chapauthenabled properties of the respective iscsi storage device on the host system. You can navigate through [HostSystem] > config > storagedevice > hostbusadapter["key-vim.host.internetscsihba-*"] > authenticationproperties > chapauthenabled to view the property. Note: [HostSystem] is the Managed Object Reference to a host system. Table 3-17 lists the messages for this check. Table 3-17 iscsi CHAP authentication check messages STKU_ISCSICHAPDISABLED STKU_ISCSIDISABLED iscsi CHAP disabled iscsi disabled MAC address changes This check verifies if the MAC address change is not set to Accept. The check verifies that for every vswitch and every port group the security policy for MAC address changes is not set to Accept. To determine the policy for MAC address change, the check refers to the following properties: config.network.portgroup[ ].computedpolicy.security.macchanges config.network.vswitch[ ].computedpolicy.security.macchanges

38 38 ESM Modules for ESX and ESXi servers ESX Network Use the Managed Object Browser (MOB) to navigate through [HostSystem] > config > network > HostPortGroup[] > computedpolicy > security > macchanges and [HostSystem] > config > network > vswitch[ ] > spec > policy > security > macchanges to view the properties. Note: [HostSystem] is the Managed Object Reference to a host system. Table 3-18 lists the messages for this check. Table 3-18 MAC address changes check messages STKU_MACADDRCHANGS MAC address changes accepted Forged transmission This check verifies if the Forged transmission is not set to Accept. The check verifies that for every vswitch and every port group the security policy for Forged transmission is not set to Accept. To determine the policy for MAC address changes, the check refers to the following properties: config.network.portgroup[ ].computedpolicy.security.forgedtransmits config.network.vswitch[ ].computedpolicy.security.forgedtransmits Use the Managed Object Browser (MOB) to navigate through [HostSystem] > config > network > HostPortGroup[] > computedpolicy > security > forgedtransmits and [HostSystem] > config > network > vswitch[ ] > spec > policy > security > forgedtransmits to view the properties. Note: [HostSystem] is the Managed Object Reference to a host system. Table 3-19 lists the messages for this check. Table 3-19 Forged transmission check messages STKU_FORGEDTRANS Forged transmission accepted