vCenter Configuration Manager Security Environment Requirements
TECHNICAL WHITE PAPER / 29
13.1 Provisioning zone is secure
OS Provisioning operations take place across the network that connects the OS Provisioning Server and the
provisionable target hosts shown in Figure 3. The provisioning zone, including its hosts, network, and network
infrastructure must be protected from unauthorized access and tampering, and must be kept available and responsive.
The provisioning zone network should be a private network. A separate dedicated network interface should be used to
connect the OS Provisioning Server to the provisioning zone's network, as described in the VCM Installation and
Getting Started Guide section "Private Network Interface." Access to the provisioning zone should be restricted to
personnel trusted to install operating systems and act as network administrators.
13.2 Dedicated OS provisioning server host
VCM relies on the OS Provisioning Server host to protect the confidentiality, integrity, and availability of provisioning
zone data an OS images. When the OS Provisioning Server host is used for purposes other than OS provisioning, you
risk granting unintended access to provisioning data or images. The OS Provisioning Server host should be dedicated
for provisioning operations and should not support logins except by the machine administrator and the users described
in the VCM Installation and Getting Started Guide section "Install the OS Provisioning Server".
13.3 Close unnecessary ports on the OS provisioning server
The VCM Installation and Getting Started Guide declares network ports used by the OS Provisioning Server. All other
ports should be kept closed using the iptables host firewall.
13.4 Protect baseline OS images
The OS Provisioning Server deploys OS images built from original distribution OS images from Microsoft, Red Hat,
SUSE, VMware, and others. These images must be obtained from trusted sources over integrity protected channels
and protected from tampering.
13.5 Preserve SSL tunnel
As shown in the above figure, VCM communicates with the OS Provisioning Server over an SSL tunnel using Stunnel.
The "Configuring the OS Provisioning Server Integration with VCM" section in the VCM Installation and Getting
Started Guide describes how to configure the Stunnel to listen only on address 127.0.0.1:21307 and to use SSL
certificates to secure the connection. The security of this tunnel must not be defeated by weak configuration, by
disabling SSL, or installing untrustworthy certificates.
13.6 Protect credentials
VCM protects and encrypts credentials stored on server zone machines. However, during OS provisioning operations,
credentials within boot distributions sent to target machines are transmitted cleartext across TFTP. This is an intrinsic
limitation of the PXE boot protocol and makes credentials subject to attacks that can sacrifice the confidentiality,
integrity, and authenticity of the credentials or other secrets in the provisioned operating systems.
(73 pagine)
Manymanuals.com
Manymanuals.de
Manymanuals.fr
Manymanuals.it
Manymanuals.pl
Manymanuals.cz
Manymanuals.es
Manymanuals-pt.com
Commenti su questo manuale