WEBVTT 00:00:00.000 --> 00:00:02.000 Welcome back to vSphere 8 in the real world. 00:00:02.000 --> 00:00:04.000 Now we're going to discuss securing vCenter Server. 00:00:07.400 --> 00:00:10.000 So probably one of the most important things, 00:00:10.000 --> 00:00:12.100 one of the most, you know, the first things you're going to do 00:00:12.100 --> 00:00:14.000 when you're configuring vCenter 00:00:14.000 --> 00:00:15.400 is during the installation process, 00:00:15.400 --> 00:00:16.799 even installing vCenter, 00:00:16.799 --> 00:00:19.500 is you're going to configure your single sign-on source. 00:00:19.500 --> 00:00:23.799 Now, you can let vCenter be its own single sign-on source, 00:00:23.799 --> 00:00:26.900 or you can also configure it for, 00:00:26.900 --> 00:00:29.000 to use another third-party service, 00:00:29.000 --> 00:00:30.600 like, for example, the most common one, 00:00:30.600 --> 00:00:32.400 the one you see all the time, 00:00:32.400 --> 00:00:34.400 is Active Directory Directory Services. 00:00:34.400 --> 00:00:36.700 So Active Directory can also be 00:00:36.700 --> 00:00:38.799 the single sign-on source for vCenter. 00:00:38.799 --> 00:00:42.900 It's very common, almost every time I think I've seen it, 00:00:42.900 --> 00:00:44.900 where they install vCenter 00:00:44.900 --> 00:00:46.700 and it has its own single sign-on source, 00:00:46.700 --> 00:00:48.000 and then they add Active Directory. 00:00:48.000 --> 00:00:50.400 It's an additional single sign-on source later. 00:00:50.400 --> 00:00:53.200 So you can use the administrator at vSphere.local, 00:00:53.200 --> 00:00:55.299 and I see that almost everywhere. 00:00:55.299 --> 00:00:57.700 You don't have to use at vSphere.local, 00:00:57.700 --> 00:00:59.099 but it seems like everyone is using 00:00:59.099 --> 00:01:02.299 that kind of default one there, 00:01:02.299 --> 00:01:04.699 with a, hopefully, very secure password, 00:01:04.699 --> 00:01:07.599 especially if you are using the app vSphere.local, 00:01:07.599 --> 00:01:10.199 because if I'm someone trying to break into a network, 00:01:10.199 --> 00:01:13.500 that would be the very first username I would try, 00:01:13.500 --> 00:01:16.400 and try and get passwords in order to access vCenter. 00:01:16.400 --> 00:01:20.500 All right, so, and with these other things, 00:01:20.500 --> 00:01:23.400 also, of course, you want to have trusted certificates. 00:01:23.400 --> 00:01:25.800 You want certificates that you can trust when you sign in 00:01:25.900 --> 00:01:29.699 using your secure username and your secure password. 00:01:29.699 --> 00:01:31.500 All this communication is encrypted, 00:01:31.500 --> 00:01:35.699 and it's encrypted using a certificate that you trust. 00:01:35.699 --> 00:01:38.000 You trust the identity of the server, 00:01:38.000 --> 00:01:40.400 because the certificate in the address bar is green 00:01:40.400 --> 00:01:43.199 and tells you, yep, this is the trusted CA. 00:01:43.199 --> 00:01:46.400 This certificate name matches the name of the address bar. 00:01:46.400 --> 00:01:47.599 All of that matches up, 00:01:47.599 --> 00:01:49.500 so I know I'm signed into the right place, 00:01:49.500 --> 00:01:51.900 and then we can have trusted encryption as well, 00:01:51.900 --> 00:01:53.400 so we know that our passwords 00:01:53.400 --> 00:01:55.300 aren't going to be stolen and things like that. 00:01:55.300 --> 00:01:58.599 So, we want our vCenter communication to be encrypted. 00:01:58.599 --> 00:02:01.199 Now, DNS can be encrypted. 00:02:01.199 --> 00:02:02.900 Not many people use encrypted DNS. 00:02:02.900 --> 00:02:05.300 That's something you're starting to barely see now, 00:02:05.300 --> 00:02:06.199 but some. 00:02:06.199 --> 00:02:08.399 Mail is much more often encrypted 00:02:08.399 --> 00:02:10.100 using, like, TLS or something like that, 00:02:10.100 --> 00:02:11.800 so if you're going to have vCenter, you know, 00:02:11.800 --> 00:02:13.899 sending account messages to a mail server, 00:02:13.899 --> 00:02:16.500 you probably want encryption configured with TLS. 00:02:16.500 --> 00:02:18.699 You probably don't want to use 480, right? 00:02:18.699 --> 00:02:24.500 You want to use, you know, HTTPS, you know, using 443, 00:02:24.500 --> 00:02:26.600 so that way you know the encryption of your name 00:02:26.600 --> 00:02:29.500 and your password is being sent, okay? 00:02:32.300 --> 00:02:35.300 So, some other things to consider about your vCenter server. 00:02:35.300 --> 00:02:36.899 So, the underlying physical host. 00:02:36.899 --> 00:02:41.100 vCenter is a virtual appliance, and as such, you know, 00:02:41.100 --> 00:02:43.899 it's going to be a VM on a physical host. 00:02:43.899 --> 00:02:47.300 Now, I don't care what system you have. 00:02:47.300 --> 00:02:49.899 If your physical hosts aren't secure, 00:02:49.899 --> 00:02:52.500 meaning this room that your servers are in, 00:02:52.500 --> 00:02:54.100 that data center your servers are in, 00:02:54.100 --> 00:02:57.300 the rack that your servers are in is not secure. 00:02:57.300 --> 00:03:01.899 People can walk up to your servers, your physical hosts. 00:03:01.899 --> 00:03:03.899 If they can get to your hosts, your switches, 00:03:03.899 --> 00:03:06.800 anything like that, then you're owned, 00:03:06.800 --> 00:03:08.899 and they're going to, you know, have a much, 00:03:08.899 --> 00:03:13.899 much easier time in hacking into your systems. 00:03:13.899 --> 00:03:16.800 It's very rare that hackers, other than in the movies, 00:03:16.800 --> 00:03:19.000 it's very rare that hackers that, you know, 00:03:19.000 --> 00:03:22.699 the bad actors actually physically get access to a server. 00:03:22.699 --> 00:03:24.300 They're normally in a different country 00:03:24.300 --> 00:03:27.500 on a different continent trying to break into these things, 00:03:27.500 --> 00:03:29.300 and that's one of the telltale signs, 00:03:29.300 --> 00:03:32.699 is that there's traffic going to an IP address 00:03:32.699 --> 00:03:36.100 in a, you know, a geoblock that your country, 00:03:36.100 --> 00:03:39.899 that your company doesn't normally do business with. 00:03:39.899 --> 00:03:42.500 Geoblocking would help prevent some of that. 00:03:42.500 --> 00:03:43.600 It doesn't prevent all of it, 00:03:43.600 --> 00:03:46.899 because they oftentimes will use jump boxes 00:03:46.899 --> 00:03:51.199 in the United States to get to those machines, right? 00:03:51.199 --> 00:03:54.600 So you'll take that with a grain of salt. 00:03:54.600 --> 00:03:56.899 But if they can physically get to your hosts, 00:03:56.899 --> 00:04:00.000 then they can pretty much own you very quickly. 00:04:00.000 --> 00:04:02.199 So the underlying physical security 00:04:02.199 --> 00:04:04.000 of the host is super important. 00:04:04.000 --> 00:04:06.100 Patches are really important. 00:04:06.100 --> 00:04:09.600 It's also very well known that most people 00:04:09.600 --> 00:04:13.699 who do get hit with some kind of a cyber incident 00:04:13.699 --> 00:04:18.500 got hit with a vulnerability to a machine 00:04:18.500 --> 00:04:21.100 that a patch was available for, 00:04:21.100 --> 00:04:22.600 that, you know, the vendor released, 00:04:22.600 --> 00:04:24.600 that might have released a long time ago, 00:04:24.600 --> 00:04:25.899 and it was never installed. 00:04:25.899 --> 00:04:28.000 Either it was never installed on your firewall, 00:04:28.000 --> 00:04:30.500 it was never installed from your, on Windows, 00:04:30.500 --> 00:04:32.600 your ESXi boxes were not patched, 00:04:32.600 --> 00:04:34.799 your vCenter server wasn't patched. 00:04:34.799 --> 00:04:38.200 Some component of your network was not patched, 00:04:38.200 --> 00:04:39.899 and a known vulnerability 00:04:39.899 --> 00:04:43.700 that made it very easy for them to get in was used. 00:04:43.700 --> 00:04:46.500 So patching is very, very important. 00:04:46.500 --> 00:04:49.500 Again, certificates from a strip authority 00:04:49.500 --> 00:04:52.299 is obviously going to be super important. 00:04:52.299 --> 00:04:55.200 Configuring single sign-on to use, like, for example, 00:04:55.200 --> 00:04:57.000 Active Directory Directory Service, 00:04:57.000 --> 00:04:59.399 where you have, you know, some kind of MFA configured 00:04:59.399 --> 00:05:02.000 for your admin accounts, 00:05:02.000 --> 00:05:04.600 where vCenter is going to use, like, 00:05:04.600 --> 00:05:06.600 the more advanced security, you know, 00:05:06.600 --> 00:05:09.500 settings that you probably have on your domain that, you know, 00:05:09.500 --> 00:05:11.500 your, whatever company might audit you 00:05:11.500 --> 00:05:14.399 is going to check your Active Directory policies. 00:05:14.399 --> 00:05:17.100 What is your lockout policy for user accounts? 00:05:17.100 --> 00:05:18.399 How long are they locked out for? 00:05:18.399 --> 00:05:20.200 What's your password complexity rules? 00:05:20.200 --> 00:05:22.000 Things like that, right? 00:05:22.000 --> 00:05:23.200 Some kind of external provider, 00:05:23.200 --> 00:05:25.100 are you using some kind of third-party provider 00:05:25.100 --> 00:05:27.399 for authentication? 00:05:27.399 --> 00:05:28.600 Role-based access. 00:05:28.600 --> 00:05:30.899 So you probably don't want to go in 00:05:30.899 --> 00:05:34.299 and give a user direct access, 00:05:34.299 --> 00:05:38.200 direct privileges to, you know, perform certain tasks, 00:05:38.200 --> 00:05:39.799 because then when you need to go in 00:05:39.799 --> 00:05:43.399 and let another user do that same thing, 00:05:43.399 --> 00:05:45.799 then you have to kind of do a lot of that same work over again, 00:05:45.799 --> 00:05:49.799 whereas you created a role and gave privileges to the role 00:05:49.799 --> 00:05:51.700 and then put users in that role. 00:05:51.700 --> 00:05:53.700 You know, you assign the role to the users. 00:05:53.700 --> 00:05:56.200 Then if I need to make another user 00:05:56.200 --> 00:05:57.799 able to do the same thing again, 00:05:57.799 --> 00:06:00.200 all I got to do is add them to that same role. 00:06:00.200 --> 00:06:02.100 Also using the predefined roles, 00:06:02.100 --> 00:06:04.100 I know, okay, this is my backup role. 00:06:04.100 --> 00:06:07.200 This is my virtual machine role. 00:06:07.200 --> 00:06:08.899 So by using these roles and saying, 00:06:08.899 --> 00:06:12.000 okay, I want my developers to have the VM role 00:06:12.000 --> 00:06:15.200 and only the VM role on this one cluster, 00:06:15.200 --> 00:06:17.000 now they can power on and power off 00:06:17.000 --> 00:06:19.500 and all those kinds of things, the virtual machines. 00:06:19.500 --> 00:06:21.200 If I gave them too many privileges 00:06:21.200 --> 00:06:23.500 or if I tried to give them privileges, 00:06:23.500 --> 00:06:26.500 like on a one-by-one basis, like, okay, you can power on VMs, 00:06:26.500 --> 00:06:29.200 you can power off VMs, you can read VMs, 00:06:29.200 --> 00:06:30.600 then it gets really messy, 00:06:30.600 --> 00:06:33.100 and you might find yourself giving them access 00:06:33.100 --> 00:06:35.600 to more things than you meant to as well. 00:06:35.600 --> 00:06:36.600 So use the built-in roles. 00:06:36.600 --> 00:06:38.799 Built-in roles make it very quick. 00:06:38.799 --> 00:06:39.799 They make it easy. 00:06:39.799 --> 00:06:41.700 It makes it very repeatable, 00:06:41.700 --> 00:06:43.299 and also it makes it easier to, like, 00:06:43.399 --> 00:06:45.799 find where maybe you have a weakness somewhere 00:06:45.799 --> 00:06:47.600 or something like that, because these predefined roles 00:06:47.600 --> 00:06:49.000 can be updated very easily. 00:06:51.899 --> 00:06:54.100 So another component of hardening your vCenter server 00:06:54.100 --> 00:06:56.700 is configuring a time server. 00:06:56.700 --> 00:06:59.399 So you can either use NTP, the network time protocol, 00:06:59.399 --> 00:07:03.500 or PTP, which is the precision time protocol. 00:07:03.500 --> 00:07:05.000 So the big difference between the two is 00:07:05.000 --> 00:07:07.600 NTP is all software, right? 00:07:07.600 --> 00:07:13.000 And it's going to be accurate up to the millisecond, 00:07:13.000 --> 00:07:15.700 whereas the precision time protocol 00:07:15.700 --> 00:07:19.100 actually has special hardware involved 00:07:19.100 --> 00:07:21.100 on the host that's going to be using it 00:07:21.100 --> 00:07:23.399 and on the machine it's going to be synchronizing with. 00:07:23.399 --> 00:07:25.799 And the specialized hardware can get you down 00:07:25.799 --> 00:07:29.399 to, like, the nanosecond or the picosecond maybe even. 00:07:29.399 --> 00:07:31.299 So obviously, if you're doing something 00:07:31.299 --> 00:07:33.899 that has to be just extraordinarily precise 00:07:33.899 --> 00:07:37.500 for some kind of scientific work that may be being done, 00:07:37.500 --> 00:07:40.000 maybe something like the New York Stock Exchange 00:07:40.000 --> 00:07:42.299 might want some very precise time 00:07:42.299 --> 00:07:44.600 for when trades happen and things like that. 00:07:44.600 --> 00:07:47.299 Most environments, most scenarios, 00:07:47.299 --> 00:07:50.799 NTP, the network time protocol, is going to be perfect. 00:07:50.799 --> 00:07:54.000 So you can configure your host to use an NTP server, 00:07:54.000 --> 00:07:57.100 and that will get you accurate within milliseconds. 00:07:57.100 --> 00:07:59.299 As long as your clocks are fine within five minutes, 00:07:59.299 --> 00:08:01.100 usually you're in good shape, 00:08:01.100 --> 00:08:02.799 because we're just talking about authentication. 00:08:02.799 --> 00:08:05.799 So if a user is going to authenticate into a box, 00:08:05.799 --> 00:08:08.000 their clock and where they're authenticating from 00:08:08.000 --> 00:08:10.000 into the host they're trying to authenticate to 00:08:10.000 --> 00:08:11.700 need to be within a few minutes of each other 00:08:11.700 --> 00:08:13.700 for authentication to be successful. 00:08:13.700 --> 00:08:15.799 If it's too far out of sync, 00:08:15.799 --> 00:08:18.799 then what might be happening is the host is going to assume 00:08:18.799 --> 00:08:21.399 someone's captured packets on the network, 00:08:21.399 --> 00:08:23.600 and they're trying to retransmit the packets 00:08:23.600 --> 00:08:25.200 that you used to authenticate. 00:08:25.200 --> 00:08:27.000 They're trying to retransmit those packets 00:08:27.000 --> 00:08:29.700 to authenticate again with old packets 00:08:29.700 --> 00:08:32.200 from, you know, 15 minutes ago 00:08:32.200 --> 00:08:34.099 or yesterday or something like that. 00:08:34.099 --> 00:08:35.799 They want those packets to be very current 00:08:35.799 --> 00:08:37.000 within the last few minutes. 00:08:37.000 --> 00:08:39.599 And so the default is normally five minutes. 00:08:39.599 --> 00:08:41.900 The clocks have to be synchronized within five minutes. 00:08:41.900 --> 00:08:43.599 That doesn't really give people much of a chance 00:08:43.599 --> 00:08:45.900 to retransmit authentication packets 00:08:45.900 --> 00:08:48.299 and try and use them again. 00:08:48.299 --> 00:08:52.299 All right, also time is really important for your log files. 00:08:52.299 --> 00:08:54.299 When you're going through and looking at your log files, 00:08:54.299 --> 00:08:55.900 you want to know when did something happen. 00:08:55.900 --> 00:08:58.400 Having accurate time will help you know 00:08:58.400 --> 00:09:00.299 when that event happened. 00:09:00.299 --> 00:09:04.299 So if you're looking at it and your time is off by hours 00:09:04.299 --> 00:09:06.599 on the host compared to what it really is, 00:09:06.599 --> 00:09:09.000 it's very difficult to narrow down 00:09:09.000 --> 00:09:10.599 when something actually occurred. 00:09:10.599 --> 00:09:12.400 Also clocks on a computer, 00:09:12.400 --> 00:09:13.799 they're actually usually pretty accurate, 00:09:13.799 --> 00:09:15.500 but it's possible for various reasons. 00:09:15.500 --> 00:09:19.500 They can float, meaning that they can actually slow down 00:09:19.500 --> 00:09:21.200 or speed up a little bit, 00:09:21.200 --> 00:09:22.700 and so it makes the time less accurate. 00:09:22.700 --> 00:09:24.700 And if you're using a time protocol server, 00:09:24.700 --> 00:09:26.400 it might start to float a few minutes, 00:09:26.400 --> 00:09:27.299 but by the time it gets, you know, 00:09:27.299 --> 00:09:29.299 within like even a minute or so off, 00:09:29.299 --> 00:09:31.299 it's going to synchronize again and get back. 00:09:31.299 --> 00:09:33.500 It doesn't float within, you know, minutes, 00:09:33.500 --> 00:09:35.500 within, you know, an hour. 00:09:35.500 --> 00:09:37.500 It takes days for it to happen. 00:09:37.500 --> 00:09:39.299 But they can move around a little bit. 00:09:39.299 --> 00:09:43.000 So a time protocol server just keeps those times in sync 00:09:43.000 --> 00:09:44.599 to one, your logs are accurate, 00:09:44.599 --> 00:09:47.200 so going back and looking at them has more value 00:09:47.200 --> 00:09:50.200 and also makes your authentication more secure as well. 00:09:52.599 --> 00:09:56.000 So we discussed configuring time services 00:09:56.000 --> 00:09:57.900 and we discussed hardening vCenter server. 00:09:57.900 --> 00:09:59.000 Let's go ahead and jump into vCenter 00:09:59.000 --> 00:10:01.299 and I'll show you how to do some hardening. 00:10:01.299 --> 00:10:03.500 So the most common thing that people are going to do 00:10:03.500 --> 00:10:05.500 in their vCenter server is they're going to make sure 00:10:05.500 --> 00:10:07.299 their time services are correct. 00:10:07.299 --> 00:10:09.099 So we could choose one of our hosts. 00:10:10.200 --> 00:10:11.500 We can go to configure. 00:10:13.500 --> 00:10:15.299 And we can scroll down. 00:10:18.299 --> 00:10:22.400 And we can go to, we have services here. 00:10:22.400 --> 00:10:24.500 We can go through and we can make sure 00:10:24.500 --> 00:10:27.599 that NTP is running. 00:10:29.000 --> 00:10:32.200 So NTP right now is currently stopped, right? 00:10:32.200 --> 00:10:36.200 So we might want to go there and configure NTP. 00:10:36.200 --> 00:10:38.900 So we don't have to start it right here. 00:10:38.900 --> 00:10:41.599 Actually, we can go to the NTP configuration 00:10:41.599 --> 00:10:42.799 and we can start it up. 00:10:42.799 --> 00:10:44.500 So let's go jump over to that. 00:10:46.400 --> 00:10:47.900 Let's go to time configuration 00:10:49.700 --> 00:10:52.799 and we can say we want to manually set this up. 00:10:52.799 --> 00:10:54.700 Now this is just going to be the default time, 00:10:54.700 --> 00:10:56.900 default date, right? 00:10:56.900 --> 00:10:59.099 We can also say we want to add a service 00:10:59.099 --> 00:11:00.500 and we're going to add a precision time. 00:11:00.500 --> 00:11:03.900 I don't have precision time hardware on this system. 00:11:03.900 --> 00:11:05.599 So I'm going to say I want to add NTP, 00:11:05.599 --> 00:11:06.900 the network time protocol. 00:11:08.400 --> 00:11:11.000 So we can say enable monitoring of events, 00:11:11.000 --> 00:11:12.500 like starting and stopping. 00:11:12.500 --> 00:11:14.200 Now I can say an address. 00:11:14.200 --> 00:11:16.200 So I might say pool.ntp.org. 00:11:19.799 --> 00:11:23.000 So one thing this does by using this particular address 00:11:23.000 --> 00:11:25.099 is it is a pool, right? 00:11:25.099 --> 00:11:29.000 There are individual computers at ntp.org I can point to, 00:11:29.000 --> 00:11:30.900 but pointing to a pool means I'm pointing 00:11:30.900 --> 00:11:32.299 to actually a bunch of different servers 00:11:32.299 --> 00:11:34.299 so I'm less likely to have one go down. 00:11:34.299 --> 00:11:36.200 Another common thing that people do 00:11:36.200 --> 00:11:37.500 is they'll point to a domain controller 00:11:37.500 --> 00:11:38.599 in their environment. 00:11:38.599 --> 00:11:40.400 The only thing about pointing to a domain controller 00:11:40.400 --> 00:11:41.900 in your environment is a lot of times 00:11:41.900 --> 00:11:43.900 the domain controllers are VMs 00:11:43.900 --> 00:11:45.900 and a lot of people do it, 00:11:45.900 --> 00:11:48.900 but there's also some bad practices 00:11:48.900 --> 00:11:51.000 about pointing to a VM because VMs, 00:11:51.000 --> 00:11:52.400 if the host starts to slide, 00:11:52.400 --> 00:11:54.200 the VM's time is synchronized with the host. 00:11:54.200 --> 00:11:55.599 I hope that might start to slide. 00:11:55.599 --> 00:11:57.799 There's like, it gets to be a vicious circle. 00:11:58.799 --> 00:12:01.000 Using a third party exterior one 00:12:01.000 --> 00:12:02.799 sometimes is a better situation. 00:12:04.400 --> 00:12:06.900 You might though have your host synchronize 00:12:06.900 --> 00:12:10.799 with a domain controller, even though it's a VM, 00:12:10.799 --> 00:12:13.799 and then that VM synchronizes with a third party 00:12:13.799 --> 00:12:16.000 or with a physical machine in your environment 00:12:16.000 --> 00:12:17.200 or something like that. 00:12:17.200 --> 00:12:19.400 So we can specify this here, right? 00:12:22.299 --> 00:12:24.299 So now that I've got this configured, 00:12:24.299 --> 00:12:27.000 notice it says it's running, right? 00:12:27.000 --> 00:12:28.700 So this guy is actually now in running. 00:12:28.700 --> 00:12:32.299 So if I were to go back to my services and look at NTP, 00:12:33.299 --> 00:12:35.099 it's running now. 00:12:35.099 --> 00:12:38.299 And that's really all you gotta do to configure your time 00:12:38.299 --> 00:12:40.500 is just go in, add the service, 00:12:40.500 --> 00:12:42.299 you can test it, see if it's up and running or not, 00:12:42.299 --> 00:12:44.400 see if it's synchronizing or not with you. 00:12:44.400 --> 00:12:46.700 So that is configuring NTP. 00:12:46.700 --> 00:12:48.500 The other thing you might wanna look at doing 00:12:48.500 --> 00:12:51.700 is configuring single sign-on. 00:12:51.700 --> 00:12:56.299 So click our hamburger, administration, 00:12:57.200 --> 00:13:00.900 and we have single sign-on here, configuration, 00:13:01.200 --> 00:13:04.400 and I can go to my Active Directory directory services. 00:13:04.400 --> 00:13:07.500 I can say I wanna join Active Directory. 00:13:07.500 --> 00:13:10.799 It's asking for the domain name, organization, 00:13:10.799 --> 00:13:12.700 that's optional, username and password 00:13:12.700 --> 00:13:15.200 that'll allow me to join Active Directory, right? 00:13:15.200 --> 00:13:17.299 And of course, my DNS is gonna have to be able 00:13:17.299 --> 00:13:18.900 to connect me to there. 00:13:18.900 --> 00:13:21.400 I'll say okay to that, reboot the node, 00:13:21.400 --> 00:13:23.900 and then I should join Active Directory 00:13:23.900 --> 00:13:28.599 and I should be able to authenticate into my vCenter server 00:13:28.599 --> 00:13:31.200 using Active Directory directory services.