vrealize-automation-62-hardening

Recommendations

Info

Optional Outgoing PortsPORT PROTOCOL COMMENTS80 TCP Optional. For fetching software updates. Updates can be downloaded separately and applied.123 TCP, UDP Optional. For connecting directly to NTP instead of using host time.5433 TCP, UDP Optional. For communicating with standalone PostgreSQL database.8281 TCP Optional. For communicating with an external vCenter Orchestrator instance.Identity Appliance PortsMinimum Required Incoming PortsPORT PROTOCOL COMMENTS5480 TCP Access to virtual appliance Web Management Console.7444 TCP SSO service over HTTPS.Optional Incoming PortsPORT PROTOCOL COMMENTS22 TCP Optional. SSH. The SSH service listening on port 22, or any other port, should be disabled in aproduction environment, and port 22 should be closed.Application Services Appliance PortsMinimum Required Incoming PortsPORT PROTOCOL COMMENTS8443 TCP HTTPS for App Services UI.5671 AMQP over SSL for RabbitMQ.80 TCP HTTP (used to host OOB demo content, agent binary, and CLI binary). Do not use OOB content inproduction environments.Optional Incoming PortsPORT PROTOCOL COMMENTS22 TCP Optional. SSH. The SSH service listening on port 22, or any other port, should be disabled in aproduction environment, and port 22 should be closed.Infrastructure as a Service ComponentsMinimum Required Incoming PortsCOMPONENT PORT PROTOCOL COMMENTSManager Service 443* TCP Communication with IaaS components and vRealize Automation Appliance overHTTPS.* Any virtualization hosts managed by proxy agents must also have TCP port 443 open for incoming traffic.VMware, Inc. 3401 Hillview Avenue Palo Alto CA 94304 USA Tel 877-486-9273 Fax 650-427-5001 www.vmware.comCopyright © 2008-2014 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed athttp://www.vmware.com/go/patents. VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respectivecompanies.46
Minimum Required Outgoing PortsCOMPONENT PORT PROTOCOL COMMENTSAll 53 TCP, UDP DNS.All TCP, UDP DHCP.ManagerService443 TCP Communication with vRealize Automation Appliance over HTTPS.Web site 443 TCP Communication with Manager Service over HTTPS.DistributedExecutionManagers443 TCP Communication with Manager Service over HTTPS.Proxy Agents 443 TCP Communication with Manager Service and virtualization hosts overHTTPS.Guest Agent 443 TCP Communication with Manager Service over HTTPS.ManagerService, Website1433 TCP MSSQL.Optional Outgoing PortsCOMPONENT PORT PROTOCOL COMMENTSAll 123 TCP, UDP Optional. NTP.VMware, Inc. 3401 Hillview Avenue Palo Alto CA 94304 USA Tel 877-486-9273 Fax 650-427-5001 www.vmware.comCopyright © 2008-2014 VMware, Inc. All rights reserved. This product is protected by U.S. and international copyright and intellectual property laws. VMware products are covered by one or more patents listed athttp://www.vmware.com/go/patents. VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks and names mentioned herein may be trademarks of their respectivecompanies.47
Page 1 and 2: VMwarevRealize AutomationHardening
Page 3 and 4: VMware vRealize Automation 6.2 Hard
Page 17 and 18: Bootloader AuthenticationIf the sys
Page 19 and 20: section.[{ssl, [{versions, ['tlsv1.
Page 21 and 22: The preferred server cipher is TLS_
Page 23 and 24: ]},{rabbit, [{ssl_listeners, [5672]
Page 25 and 26: 499900 48 -rwsr-x--- 1 root message
Page 27 and 28: PostgreSQL (vRealize Appliance)Clie
Page 29 and 30: Prevent the Bluetooth protocol hand
Page 31 and 32: Appletalk ProtocolYou should preven
Page 33 and 34: Verify Host Server’s Secure Basel
Page 35 and 36: Delete and Disable Unnecessary Appl
Page 37 and 38: Identity ApplianceCreate a blank se
Page 39 and 40: Disable IPv4 Proxy ARPIPv4 Proxy AR
Page 41 and 42: Deny IPv4 forwardingIf the system i
Page 43 and 44: Deny IPv6 Router PrefixThe accept r
Page 45: Ports Required to be Exposed to Adm

vrealize-automation-62-hardening

Create successful ePaper yourself

Delete template?

Save as template?