vrealize-automation-62-hardening

Prevent the Bluetooth protocol handler module from loading by default on vRealize Appliances.Review the /etc/modprobe.conf.local file and ensure that the following line appears.install bluetooth /bin/trueStream Control Transmission Protocol (SCTP)The Stream Control Transmission Protocol (SCTP) module should be prevented from loading unless it is absolutelynecessary. SCTP is an IETF-standardized transport layer protocol, which is not used. Binding this protocol to thenetwork stack increases the attack surface of the host. Unprivileged local processes could cause the kernel todynamically load a protocol handler by opening a socket by using the protocol.Prevent the SCTP module from loading by default on vRealize Appliances.Review the /etc/modprobe.conf.local file and ensure that the following appears.install sctp /bin/trueDatagram Congestion Control Protocol (DCCP)The Datagram Congestion Control Protocol (DCCP) module should be prevented from loading unless it is absolutelynecessary. DCCP is a proposed transport layer protocol, which is not used. Binding this protocol to the network stackincreases the attack surface of the host. Unprivileged local processes could cause the kernel to dynamically load aprotocol handler by using the protocol to open a socket.Prevent the DCCP module from loading by default on vRealize Appliances.Review the /etc/modprobe.conf.local file and ensure that the following lines appears.install dccp /bin/trueinstall dccp_ipv4 /bin/trueinstall dccp_ipv6 /bin/trueNetwork BridgingThe network bridging module should be prevented from loading unless it is absolutely necessary, because it has thepotential to bypass network partitioning and security.Configure the system to not use bridging by default on vRealize Appliances.Run the following command.# rmmod bridgeReview the /etc/modprobe.conf.local file and ensure that the following line appears.install bridge /bin/falseReliable Datagram Sockets (RDS) ProtocolThe Reliable Datagram Sockets (RDS) Protocol module should be prevented from loading unless it is absolutelynecessary. Binding this protocol to the network stack increases the attack surface of the host. Unprivileged localprocesses could cause the system to dynamically load a protocol handler by using the protocol to open a socket.Prevent the RDS module from loading by default on vRealize Appliances.Review the /etc/modprobe.conf.local file and ensure that the following line appears.install rds /bin/trueVMware, Inc. 3401 Hillview Avenue Palo Alto CA 94304 USA Tel 877-486-9273 Fax 650-427-5001 www.vmware.comCopyright © 2008-2014 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed athttp://www.vmware.com/go/patents. VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respectivecompanies.29